Bump the all-dependencies group across 1 directory with 5 updates

[dependabot]

Bumps the all-dependencies group with 4 updates in the / directory: com.github.oshi:oshi-core, com.diffplug.spotless:spotless-plugin-gradle, net.ltgt.gradle:gradle-errorprone-plugin and net.ltgt.gradle:gradle-nullaway-plugin.

Updates com.github.oshi:oshi-core from 7.5.0 to 7.6.0

Release notes

Sourced from com.github.oshi:oshi-core's releases.

Release 7.6.0

Maven Central Publication Change

The oshi-dist zip is no longer published to Maven Central; download it from the GitHub release instead.

New Features

• #3652: oshi-metrics reports the OpenTelemetry reserved state for system.filesystem.usage and system.filesystem.utilization, alongside the existing used and free. The three states partition the filesystem, so the usage gauges sum to system.filesystem.limit and the utilization gauges sum to 1.0 - @​dbwiddis.
• #3660, #3678: Display.getDevicePort() reports the port a display is attached to, and on systems with X RandR, Display.getOutputName() gives the name xrandr --output accepts for it - @​ayonization, @​dbwiddis.

Behavior Changes

• #3705: OSDesktopWindow.getLocAndSize() returns a copy of the window's Rectangle and the constructor copies the one it is given, so the class honors the immutability its documentation promises. ApplicationInfo.getAdditionalInfo() returns an unmodifiable map. Code that wrote through either return value silently mutated OSHI's own state; it now has no effect, or throws UnsupportedOperationException for the map - @​dbwiddis.
• #3705: UsbDevice.compareTo() breaks ties on the unique device ID, vendor ID, product ID and serial number after comparing names, and AbstractUsbDevice implements equals() and hashCode() over the same fields. Two distinct devices sharing a name previously compared equal, so a TreeSet or SortedSet of them kept only one. The ordering is now a default method on UsbDevice, so every implementation shares it - @​dbwiddis.

Bug Fixes and Improvements

• #3651: OSFileStore now guarantees 0 <= getUsableSpace() <= getFreeSpace() <= getTotalSpace() on every platform. The three values are read by separate queries, so on a ZFS dataset or a swap-backed tmpfs they could previously contradict each other; they are now clamped downward to restore the ordering - @​dbwiddis.
• #3657: Fix the TcpState for the FFM implementation of InternetProtocolStats.getConnections() on macOS and set the process cap from the kernel - @​dbwiddis.
• #3661: Setting oshi.os.windows.hkeyperfdata to false now also skips the registry when fetching thread counters, matching its documented behavior and the existing handling for processes - @​dbwiddis.
• #3662: Reading the processor description from the registry no longer throws when a value is missing. CentralProcessor.getFeatureFlags() on Windows now reports every processor feature IsProcessorFeaturePresent() accepts, matching the PF_ defines in winnt.h - @​dbwiddis.
• #3665: NetworkParams.getRoutes() reads the routing table from the kernel through a NET_RT_DUMP sysctl on macOS, FreeBSD, DragonFly BSD and OpenBSD, rather than by running netstat twice - @​dbwiddis.
• #3670: NetworkParams.getHostName() on Linux reads the kernel host name from /proc/sys/kernel/hostname in every backend, fixing the native-free implementation, which truncated a fully qualified name at the first dot and reported localhost when the name did not resolve - @​dbwiddis.
• #3671: NetworkParams.getHostName() and getDomainName() report the empty-string sentinel when the local host name does not resolve, rather than the loopback address's localhost. NetBSD is the most affected platform, having no native host name query of its own - @​dbwiddis.
• #3672, #3674: CentralProcessor frequencies and PhysicalProcessor.getEfficiency() on Apple Silicon are correct regardless of call order and on the M4 and M5 generations. Frequencies previously fell back to a 2.4 GHz placeholder unless getProcessorIdentifier() happened to be called first, were reported a thousand times too low on the M4 and later, and a chip with more or fewer than two kinds of core was misclassified - @​dbwiddis.
• #3675: CentralProcessor.getCurrentFreq() on Apple Silicon can report the frequency the hardware actually ran at, rather than a nominal maximum that never changes. Set oshi.os.mac.cpu.frequency.ioreport to true; it is opt-in because it holds a subscription to a private framework for the lifetime of the process - @​dbwiddis.
• #3680: oshi-metrics reads a disk or network interface once per memoizer expiration window rather than once per meter, so a scrape makes one query where it previously made five or seven, and the meters of one device report the same reading. A rate computed across two of them, such as errors per packet, is now comparable - @​dbwiddis.
• #3681: GpuStats.getGpuUtilization() on Linux reads NVIDIA GPU utilization from NVML. It previously read only the amdgpu/i915/xe sysfs paths, none of which the NVIDIA driver exposes, so an NVIDIA card always returned the -1 sentinel - @​Krillsson.
• #3686: GpuStats.getGpuUtilization() on Windows reads NVIDIA utilization from NVML and AMD utilization from ADL, matching the source order of every other metric on the class. It previously ran only LibreHardwareMonitor and a PDH engine-tick delta, which needs two samples, so the first call returned the -1 sentinel - @​dbwiddis.
• #3687: GpuStats.getSharedMemoryUsed() on Linux reports the amdgpu GTT memory in use rather than always returning -1, and GraphicsCard.getVRam() on an amdgpu card reports the driver's own figure rather than the memory BAR size parsed from lspci or lshw. Several GpuStats metrics on Linux also now return the -1 sentinel when the sysfs file behind them is absent; they previously reported 0, so a card whose hwmon directory omits power1_average read as drawing 0.0 W - @​dbwiddis.
• #3698: OSProcess.getCurrentWorkingDirectory() on macOS returns the directory rather than an empty string in the FFM implementation, and NetworkParams.getDomainName() on macOS and the BSDs returns the canonical name rather than an empty string in both implementations - @​dbwiddis.
• #3705: An AIX process or thread that exits between enumeration and the /proc read is now reported as invalid rather than as a live process owned by root - @​dbwiddis.
• #3705: A failure of kstat_open() on Solaris throws rather than releasing no lock and passing a null control structure to the kernel. The chain lock is static, so a failed open previously blocked every later kstat query on any thread - @​dbwiddis.

Full change log

Changelog

Sourced from com.github.oshi:oshi-core's changelog.

7.6.0 (2026-08-23)

The oshi-dist zip is no longer published to Maven Central; download it from the GitHub release instead.

New Features

• #3652: oshi-metrics reports the OpenTelemetry reserved state for system.filesystem.usage and system.filesystem.utilization, alongside the existing used and free. The three states partition the filesystem, so the usage gauges sum to system.filesystem.limit and the utilization gauges sum to 1.0 - @​dbwiddis.
• #3660, #3678: Display.getDevicePort() reports the port a display is attached to, and on systems with X RandR, Display.getOutputName() gives the name xrandr --output accepts for it - @​ayonization, @​dbwiddis.

Behavior Changes

• #3705: OSDesktopWindow.getLocAndSize() returns a copy of the window's Rectangle and the constructor copies the one it is given, so the class honors the immutability its documentation promises. ApplicationInfo.getAdditionalInfo() returns an unmodifiable map. Code that wrote through either return value silently mutated OSHI's own state; it now has no effect, or throws UnsupportedOperationException for the map - @​dbwiddis.
• #3705: UsbDevice.compareTo() breaks ties on the unique device ID, vendor ID, product ID and serial number after comparing names, and AbstractUsbDevice implements equals() and hashCode() over the same fields. Two distinct devices sharing a name previously compared equal, so a TreeSet or SortedSet of them kept only one. The ordering is now a default method on UsbDevice, so every implementation shares it - @​dbwiddis.

Bug Fixes and Improvements

• #3651: OSFileStore now guarantees 0 <= getUsableSpace() <= getFreeSpace() <= getTotalSpace() on every platform. The three values are read by separate queries, so on a ZFS dataset or a swap-backed tmpfs they could previously contradict each other; they are now clamped downward to restore the ordering - @​dbwiddis.
• #3657: Fix the TcpState for the FFM implementation of InternetProtocolStats.getConnections() on macOS and set the process cap from the kernel - @​dbwiddis.
• #3661: Setting oshi.os.windows.hkeyperfdata to false now also skips the registry when fetching thread counters, matching its documented behavior and the existing handling for processes - @​dbwiddis.
• #3662: Reading the processor description from the registry no longer throws when a value is missing. CentralProcessor.getFeatureFlags() on Windows now reports every processor feature IsProcessorFeaturePresent() accepts, matching the PF_ defines in winnt.h - @​dbwiddis.
• #3665: NetworkParams.getRoutes() reads the routing table from the kernel through a NET_RT_DUMP sysctl on macOS, FreeBSD, DragonFly BSD and OpenBSD, rather than by running netstat twice - @​dbwiddis.
• #3670: NetworkParams.getHostName() on Linux reads the kernel host name from /proc/sys/kernel/hostname in every backend, fixing the native-free implementation, which truncated a fully qualified name at the first dot and reported localhost when the name did not resolve - @​dbwiddis.
• #3671: NetworkParams.getHostName() and getDomainName() report the empty-string sentinel when the local host name does not resolve, rather than the loopback address's localhost. NetBSD is the most affected platform, having no native host name query of its own - @​dbwiddis.
• #3672, #3674: CentralProcessor frequencies and PhysicalProcessor.getEfficiency() on Apple Silicon are correct regardless of call order and on the M4 and M5 generations. Frequencies previously fell back to a 2.4 GHz placeholder unless getProcessorIdentifier() happened to be called first, were reported a thousand times too low on the M4 and later, and a chip with more or fewer than two kinds of core was misclassified - @​dbwiddis.
• #3675: CentralProcessor.getCurrentFreq() on Apple Silicon can report the frequency the hardware actually ran at, rather than a nominal maximum that never changes. Set oshi.os.mac.cpu.frequency.ioreport to true; it is opt-in because it holds a subscription to a private framework for the lifetime of the process - @​dbwiddis.
• #3680: oshi-metrics reads a disk or network interface once per memoizer expiration window rather than once per meter, so a scrape makes one query where it previously made five or seven, and the meters of one device report the same reading. A rate computed across two of them, such as errors per packet, is now comparable - @​dbwiddis.
• #3681: GpuStats.getGpuUtilization() on Linux reads NVIDIA GPU utilization from NVML. It previously read only the amdgpu/i915/xe sysfs paths, none of which the NVIDIA driver exposes, so an NVIDIA card always returned the -1 sentinel - @​Krillsson.
• #3686: GpuStats.getGpuUtilization() on Windows reads NVIDIA utilization from NVML and AMD utilization from ADL, matching the source order of every other metric on the class. It previously ran only LibreHardwareMonitor and a PDH engine-tick delta, which needs two samples, so the first call returned the -1 sentinel - @​dbwiddis.
• #3687: GpuStats.getSharedMemoryUsed() on Linux reports the amdgpu GTT memory in use rather than always returning -1, and GraphicsCard.getVRam() on an amdgpu card reports the driver's own figure rather than the memory BAR size parsed from lspci or lshw. Several GpuStats metrics on Linux also now return the -1 sentinel when the sysfs file behind them is absent; they previously reported 0, so a card whose hwmon directory omits power1_average read as drawing 0.0 W - @​dbwiddis.
• #3698: OSProcess.getCurrentWorkingDirectory() on macOS returns the directory rather than an empty string in the FFM implementation, and NetworkParams.getDomainName() on macOS and the BSDs returns the canonical name rather than an empty string in both implementations - @​dbwiddis.
• #3705: An AIX process or thread that exits between enumeration and the /proc read is now reported as invalid rather than as a live process owned by root - @​dbwiddis.
• #3705: A failure of kstat_open() on Solaris throws rather than releasing no lock and passing a null control structure to the kernel. The chain lock is static, so a failed open previously blocked every later kstat query on any thread - @​dbwiddis.

Commits

• 430f530 [maven-release-plugin] prepare release oshi-parent-7.6.0
• ae8b7bb 7.6.0 Release
• d7e05aa Report an absent SMC once instead of on every sensor query, and quiet the stu...
• 2382a05 Fix what SpotBugs and Sonar found (#3705)
• 1534790 Update vmactions/freebsd-vm digest to d0518f9 (#3702)
• 161dbee Run AppVeyor on JDK 25, and correct what pins testRelease
• a93b66e Bring the new audit jobs onto upload-artifact v7
• 8dde9a9 Extend the FFM layout audit to the Unix platforms, and fix what it found (#3701)
• 3141850 Update vmactions/freebsd-vm digest to d0518f9 (#3699)
• 75aabd0 Update actions/upload-artifact action to v7 (#3700)
• Additional commits viewable in compare view

Updates com.diffplug.spotless:spotless-plugin-gradle from 8.10.0 to 8.10.1

Release notes

Sourced from com.diffplug.spotless:spotless-plugin-gradle's releases.

Gradle Plugin v8.10.1

Fixed

• prettier() and other npm-based steps no longer fail to start on npm 12 (EUNKNOWNCONFIG from --scripts-prepend-node-path). (#3024)
• spotlessInternalRegisterDependencies now writes its output under a build directory that is configured after the plugin is applied, instead of always under the default build/. (#2114)
• targetExclude now accepts a Gradle Directory, DirectoryProperty, or Provider<Directory> and excludes the files under it. Previously the directory was treated as a single file, so excluding one silently did nothing. (#2667)

Commits

• f2f2348 Published gradle/8.10.1
• 4bc8980 Published lib/4.10.1
• 6fedfd5 chore(deps): update plugin errorprone to v5.1.1 (#3035)
• 5e10f0b chore(deps): update plugin errorprone to v5.1.1
• 3aa82b5 fix: expand a directory passed to targetExclude into the files under it (#3032)
• 68bddde shortenFullyQualifiedTypes: skip FQNs whose simple name clashes with types de...
• 6f73ed3 fix(deps): update dependency org.codehaus.plexus:plexus-utils to v4.1.0 (#3030)
• bdeafe7 docs: changelog entry for the targetExclude directory fix
• 4187eb3 fix: expand a directory passed to targetExclude into the files under it
• cd525f2 shortenFullyQualifiedTypes: skip FQNs clashing with types declared in the sam...
• Additional commits viewable in compare view

Updates net.ltgt.gradle:gradle-errorprone-plugin from 5.1.0 to 5.1.1

Release notes

Sourced from net.ltgt.gradle:gradle-errorprone-plugin's releases.

v5.1.1

Stop configuring Configuration.visible on the errorprone configuration (#188, eb7b2eff9ba4b04437edeeea5f13d228f136d3f2)

This release also no longer uses Kotlin to expose its Kotlin extension function/property, but now relies on the Gradle Kotlin Accessors Generator. This shouldn't have any side effect but is probably worth mentioning as a source of possible regressions in some specific setups.

Commits

• eb7b2ef Stop configuring Configuration.visible
• e043cef Update Gradle to 9.7.1
• 83b5f77 Upgrade to Gradle Kotlin Accessors Generator 0.2.0
• 4b16e4b Migrate from Kotlin to Gradle Kotlin Accessors Generator
• 543d826 Bump com.diffplug.spotless from 8.9.0 to 8.10.0 in the all-minor group
• 6e94a41 Bump org.junit.jupiter:junit-jupiter-api in the all-minor group
• 9ad0210 Bump com.google.googlejavaformat:google-java-format
• 4e859fe Bump com.diffplug.spotless from 8.8.0 to 8.9.0 in the all-minor group
• e15f6f0 Bump com.uber.nullaway:nullaway in the all-minor group
• 4b54655 Bump org.junit.jupiter:junit-jupiter-api in the all-minor group
• Additional commits viewable in compare view

Updates net.ltgt.gradle:gradle-nullaway-plugin from 3.1.0 to 3.2.0

Release notes

Sourced from net.ltgt.gradle:gradle-nullaway-plugin's releases.

v3.2.0

Add support for -XepOpt:NullAway:JSpecifyExperimental and -XepOpt:NullAway:JSpecifyJDKModels (#85, f4c309eb385791d2768edeee2a0b9f16354ffbba)

This release also no longer uses Kotlin to expose its Kotlin extension function/property, but now relies on the Gradle Kotlin Accessors Generator. This shouldn't have any side effect but is probably worth mentioning as a source of possible regressions in some specific setups.

Commits

• f4c309e Add support for -XepOpt:NullAway:JSpecifyExperimental and -XepOpt:NullAway:JS...
• 8ffe2cb Update to Gradle 9.7.1
• 266f95b Upgrade to Gradle Kotlin Accessors Generator 0.2.0
• 53618f2 Migrate from Kotlin to Gradle Kotlin Accessors Generator
• a24ba9f Bump com.diffplug.spotless from 8.8.0 to 8.9.0 in the all-minor group
• 671d769 Bump com.uber.nullaway:nullaway in the all-minor group
• c8a482b Bump org.junit.jupiter:junit-jupiter-api in the all-minor group
• 5dad0ea Bump the all-minor group with 3 updates
• 7401000 Bump the all-minor group across 1 directory with 2 updates
• 1abfcc7 Update to Gradle 9.6.0
• Additional commits viewable in compare view

Updates com.diffplug.spotless from 8.10.0 to 8.10.1

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions