fix(deps): update all dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Age	Confidence
github/codeql-action	action	patch	v4.37.6 → v4.37.7
gradle (source)		patch	9.7.0 → 9.7.1
com.google.guava:guava	dependencies	minor	33.6.0-jre → 33.7.1-jre
com.fasterxml.jackson.core:jackson-core	dependencies	patch	2.22.1 → 2.22.2
com.fasterxml.jackson.core:jackson-databind (source)	dependencies	patch	2.22.1 → 2.22.2
tools.jackson.core:jackson-core	dependencies	patch	3.2.1 → 3.2.2
tools.jackson.core:jackson-databind (source)	dependencies	minor	3.1.5 → 3.2.2
org.codehaus.plexus:plexus-utils (source)	dependencies	minor	4.0.3 → 4.1.0
com.squareup.okhttp3:okhttp (source)	dependencies	minor	5.4.0 → 5.5.0
com.datadoghq:datadog-api-client	dependencies	minor	2.56.0 → 2.59.0
com.gradleup.shadow	plugin	minor	9.2.2 → 9.6.1

---

Release Notes

github/codeql-action (github/codeql-action)

v4.37.7

Compare Source

• Update default CodeQL bundle version to 2.26.3. #​4085

gradle/gradle (gradle)

v9.7.1

Compare Source

lysine-dev/okhttp (com.squareup.okhttp3:okhttp)

v5.5.0

2026-08-16

This release introduces opt-in support for [Encrypted Client Hello (ECH)]. This new feature
improves user privacy by encrypting domain names in transit. With regular TLS, your coffee shop’s
Wi-Fi router can see that you’re visiting wikipedia.com, but it cannot see which page you’re
looking at. With ECH, the router observes only the IP address. This additional privacy is most
effective on sites hosted by big CDNs because the IP address doesn’t imply a particular website.

This requires ECH support in the platform’s TLS stack. Today this is only Android 17 (API 37,
released June 2026). When other TLS stacks add ECH support, we'll integrate them.

ECH took a lot of work to implement because the encryption keys are published over DNS in the
[HTTPS resource record], and we needed to write new code to fetch these records. This release
includes a major update to OkHttp’s DNS API: it now supports multiple resource record types (not
just IP addresses!), asynchronous streaming results, and in-memory caching.

To opt in, you can use DnsOverHttps:

// DnsOverHttps itself uses OkHttpClient. Build both clients upon the
// same bootstrap client so they share a connection pool and dispatcher.
val bootstrapClient = OkHttpClient()

// This sample uses Cloudflare's 1.1.1.1 DnsOverHttps service.
val client = bootstrapClient.newBuilder()
  .dns(DnsOverHttps.Builder()
    .client(bootstrapClient)
    .url("https://1.1.1.1/dns-query".toHttpUrl())
    .build())
  .build()

You could also opt in with our new AndroidDns API. Unfortunately, the privacy benefits of ECH are
deficient because its DNS queries are not encrypted by default.

// AndroidDns fetches the HTTPS DNS resource records necessary for ECH.
val client = OkHttpClient.Builder()
  .dns(AndroidDns())
  .build()

• New: OkHttp artifacts is now signed with our [new signing key]. This project and three sibling
  projects ([Retrofit], [Okio], and [SQLDelight]) recently joined [the Commonhaus Foundation].
• Fix: MockWebServer’s @StartStop annotation now supports @Nested JUnit 5 tests.
• Fix: Our default TLS hostname verifier now reject hosts that fail IP canonicalization.
• Fix: Closing a multipart part's sink no longer closes the entire request body.
• Fix: Flush HTTP/1 request bodies before detaching the timeout. We had a bug where timeouts
  weren’t applied correctly.
• Fix: Follow [RFC 1008]'s requirements for HTTP QUERY redirects.
• Fix: Fall back to no proxy when the system proxy selector throws. Previously this would cause
  the HTTP call to crash.
• Upgrade: [Okio 3.18.1][okio_3_18_1].

DataDog/datadog-api-client-java (com.datadoghq:datadog-api-client)

v2.59.0

Changed

• 200 col lim explicit in api docs #​4175
• Add GET/PATCH /api/v2/ci/github/accounts to CI Visibility spec #​4164
• Mark supported_values as nullable and remove unused detection_frequency in Governance Console API #​4161

Added

• Add llm-observability alert monitor type #​4174
• Add allowed_resources to Deployment Gates FDD rule options #​4173
• Document meta.idempotency_key in CreateDegradation and UpdateDegradation #​4167
• Add spec for maintenance update edit endpoint #​4158
• Document PATCH /api/v2/dora/deployments #​4154

Removed

• Update Status Pages UpdateStatusPage documentation to reflect enabled attribute deprecation #​4171
• Make RUM rate limit config API private pending rename #​4165

Fixed

• Remove redundant otel fields from Fleet Automation v2 agent detail endpoint #​4163

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 8.61%. Comparing base (71c4956) to head (c339308).

Additional details and impacted files

@@            Coverage Diff             @@
##              main   #1141      +/-   ##
==========================================
- Coverage     9.69%   8.61%   -1.08%     
+ Complexity    2057    1625     -432     
==========================================
  Files         8495    8495              
  Lines        81484   81484              
  Branches       363     363              
==========================================
- Hits          7896    7021     -875     
- Misses       73396   74296     +900     
+ Partials       192     167      -25     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.