[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
org.sonarsource.analyzer-commons:sonar-performance-measure (source)	2.33.0.5369 → 2.34.0.15495
org.sonarsource.analyzer-commons:sonar-regex-parsing (source)	2.33.0.5369 → 2.34.0.15495
org.sonarsource.analyzer-commons:sonar-analyzer-test-commons (source)	2.33.0.5369 → 2.34.0.15495
org.sonarsource.analyzer-commons:sonar-xml-parsing (source)	2.33.0.5369 → 2.34.0.15495
org.sonarsource.analyzer-commons:sonar-analyzer-recognizers (source)	2.33.0.5369 → 2.34.0.15495
org.sonarsource.analyzer-commons:sonar-analyzer-commons (source)	2.33.0.5369 → 2.34.0.15495

---

Release Notes

SonarSource/sonar-analyzer-commons (org.sonarsource.analyzer-commons:sonar-performance-measure)

v2.34.0.15495

Compare Source

Release notes - Sonar Analyzer Commons - 2.34

Feature

ACOMMONS-164 IpAddressClassifier: Support IPv4-mapped IPv6 literals

Maintenance

ACOMMONS-183 Prepare next development iteration 2.34
ACOMMONS-184 Update dependency jdx/mise to v2026.9.10
ACOMMONS-188 Update dependency jdx/mise to v2026.9.11
ACOMMONS-190 Update dependency jdx/mise to v2026.9.12
ACOMMONS-191 Update SonarSource/sonar-scanner-engine monorepo to v13.14.0.6149
ACOMMONS-193 Update dependency org.mockito:mockito-core to v5.24.0
ACOMMONS-194 Update dependency org.sonarsource.parent:parent to v88
ACOMMONS-195 Update dependency jdx/mise to v2026.9.13
ACOMMONS-196 Update dependency jdx/mise to v2026.9.14
ACOMMONS-197 Update SonarSource/sonar-plugin-api monorepo to v14.1.0.5543
ACOMMONS-198 Preserve npm package integrity across Repox and public npm
ACOMMONS-199 Update dependency jdx/mise to v2026.9.15
ACOMMONS-200 Update dependency jdx/mise to v2026.9.16
ACOMMONS-201 Update jdx/mise-action action to v5
ACOMMONS-202 Update dependency com.fasterxml.woodstox:woodstox-core to v7.3.0
ACOMMONS-203 Update dependency jdx/mise to v2026.9.17
ACOMMONS-204 Update dependency jdx/mise to v2026.9.18
ACOMMONS-205 Update SonarSource/sonar-scanner-engine monorepo to v13.15.0.6376
ACOMMONS-206 Update jdx/mise-action action to v5.0.1
ACOMMONS-207 Update dependency jdx/mise to v2026.10.0
ACOMMONS-208 Update dependency org.snakeyaml:snakeyaml-engine to v3.2
ACOMMONS-209 Update jdx/mise-action action to v5.1.0
ACOMMONS-210 Update jdx/mise-action action to v5.1.1
ACOMMONS-211 Update jdx/mise-action action to v5.1.1
ACOMMONS-212 Update actions/download-artifact action to v8.0.2
ACOMMONS-213 Update actions/upload-artifact action to v7.0.2
ACOMMONS-214 Update actions/setup-node action to v7.1.0
ACOMMONS-215 Update SonarSource/sonar-plugin-api monorepo to v14.2.0.5584
ACOMMONS-216 Update jdx/mise-action action to v5.1.2
ACOMMONS-217 Introduce shared IP address extraction with IpAddressExtractor
ACOMMONS-218 Update SonarSource/sonar-scanner-engine monorepo to v13.16.0.6705
ACOMMONS-219 Update jdx/mise-action action to v5.2.0

---

Configuration

📅 Schedule: (in timezone CET)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

---

Summary by Gitar

• Build configuration:
  • Added license-maven-plugin config in pluginManagement to merge bsd into The BSD 2-Clause License
  • Deleted override-dep-licenses.properties and removed its overrideUrl argument from build.yml

_{This will update automatically on new commits.}

[hashicorp-vault-sonar-prod]

Renovate Jira issue ID: SONARJAVA-7224

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[gitar-bot]

Code Review ✅ Approved

🟡 Medium risk · Updating analyzer commons adds IPv4-mapped IPv6 handling and shared IP extraction, which could change network-address classification in dependent analyzer behavior.

Bumps the sonar-analyzer-commons monorepo dependencies from 2.33.0.5369 to 2.34.0.15495 across six artifacts and normalizes license configuration for the build. No issues found.

Verification Rules 2/3 met PRs 3 inspected

Rules 1 failed 2 passed

❌ Approved GitHub Actions runners - The retired sonar-xs-public label is used in build.yml (line 484) and several other workflows (pr-cleanup, releasability, UpdateRuleMetadata, mark-prs-stale, ReleasabilityCheck, ToggleLockBranch, PrepareNextIteration, cleanup-cache). Replace it with sonar-xs (generic Linux) or github-ubuntu-latest-s for release/public workloads, per the internal GitHub Actions runners guidance on the Platform team wiki.
✅ Internal artifact registries
✅ Repository license compliance

Functional validation No results

Broader impact PRs 3 inspected

Cross-PR 3 PRs inspected 0 open impacts

PR 823: SONARKT-824 S1313: Adopt IpAddressClassifier for hardcoded-IP filtering in sonar-kotlin Inspected
PR 1848: SONARPHP-1927 S1313 Adopt IpAddressClassifier for hardcoded-IP filtering in sonar-php Inspected
PR 145: Update Analyzer Commons to v2.33.0.5369 Inspected

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube