[bernardladenthin]

Summary

Part of the 2026-10-20 cross-repo dependency sweep (one PR each in BAF, java-llama.cpp, streambuffer, BroomCabinet and workspace).

• Jackson 2.22.3 → 2.22.4 (the CLI's JSON/YAML configuration binding)
• anthropics/claude-code-action v1.0.251 → v1.0.255, now the same commit in all four repos. Gradle 9.8.1 → 9.8.2 in the shared verify-signing-key-gradle job.
• shared-files.sha256 rewritten, including the scorecard.yml / osv-scanner.yml hashes that Dependabot's action bumps had left stale

Deliberately unchanged: jqwik 1.9.3, and net.ladenthin:llama:6.0.0. That release is not on Central yet, so the build stays red until it is published, as the pom comment says. That is also why I could not run the module tests here: the 6.0.0 natives jars do not exist locally either.

Test plan

• Affected unit / integration tests pass locally: not possible, see above. Jackson 2.22.4 itself compiled and passed the config-binding tests in BAF and java-llama.cpp.
• check-shared-files.py --write and check-run-scripts.py are clean
• CI is green on this branch (expected red until llama 6.0.0 is published, independent of this PR)
• Docs / CHANGELOG updated where applicable

Related issues / PRs

Sibling PRs of the same sweep in BAF, java-llama.cpp, streambuffer, BroomCabinet and workspace.

Checklist

• I have read CONTRIBUTING.md and CODE_OF_CONDUCT.md
• My commits follow Conventional Commits
• No security-sensitive changes (if there are, I have notified the maintainer privately per SECURITY.md)

---

Generated by Claude Code