# Dependency Maintenance

The project tracks stable releases of its build tools and direct dependencies.
Alpha, beta, release-candidate, preview, EAP, milestone, and snapshot releases
are excluded from routine updates.

The informational `upstream-dependency-report` CI job runs for merge requests
and default-branch pushes. It reports upstream releases from Cargo registries,
Gradle repositories, and the Gradle release service. This upstream report is
inventory, not an upgrade recommendation, and the job does not fail when it
finds an update or cannot reach an upstream registry.

## Rust

CI uses the latest stable Rust toolchain supplied by the `rust:latest` image.
The root Cargo workspace declares the Rust 2024 edition and lint policy for all
three crates. Edition changes are deliberate source migrations; compiler
releases are adopted automatically and any resulting incompatibilities are
fixed in the repository.

Install `cargo-outdated` to reproduce the dependency report locally:

```shell
cargo install --locked --version 0.19.0 cargo-outdated
cargo outdated --workspace --root-deps-only
```

An upstream version of a direct dependency is eligible for
`minecraft-server` or `jar-wrapper-exec` only when every supported Fedora and
EPEL build target provides the required crate version and features. Versions
that exist only on crates.io are deliberately left pinned. Confirm availability
for every build target through the
[Fedora Packages database](https://packages.fedoraproject.org/) before editing
either runtime manifest. The `verify-fedora-build-dependencies` job checks the
selected versions against the current Fedora build repositories; Copr verifies
them in every configured Fedora and EPEL buildroot.

The `update-checker` is CI release tooling and is not built into the RPM, so its
Rust dependencies do not have the Fedora/EPEL packaging constraint. Update only
the selected member manifest, let Cargo synchronize the root `Cargo.lock`, and
run the full workspace checks. Runtime dependency changes may also require an
RPM license metadata update.

## Kotlin and Gradle dependencies

The Gradle Versions Plugin reports newer stable Kotlin plugins, Gradle plugins,
JVM libraries, and Gradle releases:

```shell
jar-launchers/gradlew \
    --gradle-user-home .gradle-user-home \
    --project-dir jar-launchers \
    --no-daemon \
    --no-parallel \
    dependencyUpdates
```

Update versions in `jar-launchers/build.gradle.kts` and
`jar-launchers/settings.gradle.kts`, then run the Gradle format, test, and build
checks documented in the [README](../README.md#building).

## Gradle Wrapper

The Gradle Wrapper consists of `gradlew`, `gradlew.bat`,
`gradle/wrapper/gradle-wrapper.jar`, and
`gradle/wrapper/gradle-wrapper.properties`. Gradle generates these files, and
all four are committed.

Obtain the binary-distribution SHA-256 value from Gradle's official
[checksum reference](https://gradle.org/release-checksums/). From
`jar-launchers/`, run the Wrapper task twice so both the selected distribution
and the wrapper implementation are generated by the target version:

```shell
./gradlew wrapper \
    --gradle-user-home ../.gradle-user-home \
    --gradle-version <version> \
    --distribution-type bin \
    --gradle-distribution-sha256-sum <sha256>
./gradlew wrapper \
    --gradle-user-home ../.gradle-user-home \
    --gradle-version <version> \
    --distribution-type bin \
    --gradle-distribution-sha256-sum <sha256>
```

Verify the selected version and compare the Wrapper JAR checksum with the same
official reference:

```shell
./gradlew --gradle-user-home ../.gradle-user-home --version
sha256sum gradle/wrapper/gradle-wrapper.jar
```
