build(deps): patch consumer-neutral dependencies

[jbeckwith-oai]

Summary

• align the example module's Azure Identity Netty runtime on 4.1.136.Final
• align WireMock's shared test-only Jetty runtime on 12.0.36
• align Bedrock's WireMock test runtime on Jackson 2.21.5

Why

Azure Identity and WireMock transitively request older patch releases covered by 21 Dependabot alerts. The direct dependencies do not yet select the fixed versions, so this adds narrow BOM alignments at the modules that own those dependency graphs.

Core and OkHttp deliberately continue testing against the SDK's published Jackson 2.18.9 baseline. The Jackson 2.21.5 alignment is scoped to Bedrock, which has no compatibility override and was otherwise resolving WireMock's 2.20.1 BOM.

Impact

There is no published SDK API or consumer migration impact. The Netty alignment applies only to the unpublished example module, while the Jetty and Jackson alignments apply only to test configurations.

Validation

• confirmed Netty resolves to 4.1.136.Final
• confirmed Jetty resolves to 12.0.36
• confirmed Bedrock resolves Jackson to 2.21.5
• confirmed core and OkHttp intentionally retain Jackson 2.18.9 compatibility runtimes
• :openai-java-bedrock:test
• :openai-java-example:classes
• ./scripts/lint
• git diff --check
• thermo-nuclear code-quality review: no blockers

[Copilot]

Pull request overview

This PR updates Gradle dependency alignment to address vulnerability-related Dependabot alerts by pinning specific patch-level runtimes for transitive dependency graphs (example module Azure Identity/Netty; test-only WireMock Jetty/Jackson).

Changes:

• Add a Netty BOM alignment in openai-java-example to keep Azure Identity’s Netty runtime on 4.1.136.Final.
• Move WireMock test runtime alignments into the shared openai.wiremock-test convention plugin (Jetty 12.0.36, Jackson BOM 2.21.5).
• Remove duplicated Jackson BOM declarations from individual test modules.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
openai-java-example/build.gradle.kts	Adds Netty BOM alignment for the example module’s Azure Identity dependency graph.
openai-java-core/build.gradle.kts	Removes module-local Jackson BOM in favor of centralized WireMock test alignment.
openai-java-client-okhttp/build.gradle.kts	Removes module-local Jackson BOM in favor of centralized WireMock test alignment.
buildSrc/src/main/kotlin/openai.wiremock-test.gradle.kts	Centralizes WireMock test-only Jetty and Jackson BOM alignments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[openai-sdks]

OkTest Summary

✅ 237/237 SDK tests passed in 16.669s for Java SDK PR #816.

Test results — 42 files

Test	Result	Time
tests/chat-completions-complex-body.test.ts	✅ Passed	519ms
tests/chat-completions-create.test.ts	✅ Passed	552ms
tests/chat-completions-stream.test.ts	✅ Passed	307ms
tests/files-content-binary.test.ts	✅ Passed	254ms
tests/files-create-multipart.test.ts	✅ Passed	269ms
tests/files-list-pagination.test.ts	✅ Passed	252ms
tests/initialize-config.test.ts	✅ Passed	165ms
tests/instance-isolation.test.ts	✅ Passed	229ms
tests/models-list.test.ts	✅ Passed	191ms
tests/responses-background-lifecycle.test.ts	✅ Passed	316ms
tests/responses-body-method-errors.test.ts	✅ Passed	519ms
tests/responses-cancel-timeout.test.ts	✅ Passed	202ms
tests/responses-cancel.test.ts	✅ Passed	347ms
tests/responses-compact-retries.test.ts	✅ Passed	449ms
tests/responses-compact.test.ts	✅ Passed	322ms
tests/responses-create-advanced-stream.test.ts	✅ Passed	245ms
tests/responses-create-advanced.test.ts	✅ Passed	1.306s
tests/responses-create-disconnect.test.ts	✅ Passed	1.154s
tests/responses-create-errors.test.ts	✅ Passed	357ms
tests/responses-create-malformed-api-responses.test.ts	✅ Passed	288ms
tests/responses-create-retries.test.ts	✅ Passed	705ms
tests/responses-create-stream-failures.test.ts	✅ Passed	289ms
tests/responses-create-stream-timeout.test.ts	✅ Passed	276ms
tests/responses-create-stream-wire.test.ts	✅ Passed	6.29s
tests/responses-create-stream.test.ts	✅ Passed	404ms
tests/responses-create-terminal-states.test.ts	✅ Passed	526ms
tests/responses-create-timeout.test.ts	✅ Passed	220ms
tests/responses-create.test.ts	✅ Passed	317ms
tests/responses-delete.test.ts	✅ Passed	245ms
tests/responses-input-items-errors.test.ts	✅ Passed	366ms
tests/responses-input-items-list.test.ts	✅ Passed	342ms
tests/responses-input-items-options.test.ts	✅ Passed	498ms
tests/responses-input-tokens-count-timeout.test.ts	✅ Passed	270ms
tests/responses-input-tokens-count.test.ts	✅ Passed	355ms
tests/responses-malformed-inputs.test.ts	✅ Passed	5.01s
tests/responses-not-found-errors.test.ts	✅ Passed	455ms
tests/responses-parse.test.ts	✅ Passed	564ms
tests/responses-retrieve-retries.test.ts	✅ Passed	327ms
tests/responses-retrieve.test.ts	✅ Passed	328ms
tests/responses-stored-method-errors.test.ts	✅ Passed	1.123s
tests/retry-behavior.test.ts	✅ Passed	3.504s
tests/sdk-error-shape.test.ts	✅ Passed	423ms

View OkTest run #30129356315

_{SDK merge (ee0ebf7ac99b) · head (da2a00ecd095) · base (e7f446dbe330) · OkTest (91635c6a2723)}

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

[HAYDEN-OAI]

Reviewed the complete current three-file diff at da2a00ecd0951a7ef4cd324cb1a268282dccbb42, including the previous resolved/outdated Jackson discussion, the live Dependabot advisories, dependency resolution, CI/security workflows, and consumer publication boundaries.

Independently verified:

• The unpublished example resolves both Azure/Reactive Netty HTTP and DNS dependencies to the fixed 4.1.136.Final without adding Netty to a published SDK artifact.
• The shared WireMock test convention resolves Jetty and EE10 to 12.0.36 across its consumers; these alignments remain test-only.
• Bedrock's WireMock test classpath resolves Jackson to 2.21.5, while Bedrock's real consumer runtime and the Core/OkHttp compatibility-test classpaths remain on the intended 2.18.9 published baseline.
• Generated and inspected both Maven POMs and Gradle module metadata for Core, OkHttp, and Bedrock: no Jetty, Netty, WireMock, Azure Identity, or 2.21.5 constraint leaks into either API or runtime publication variants.
• Successfully ran the example classes, Bedrock/OkHttp/Core tests, the Core testJacksonCompatibility suite, all targeted dependency-insight tasks, and publication metadata generation on the reviewed commit. Local tests used SKIP_MOCK_TESTS=true for external mock-server cases; the complete upstream test, lint, build/Jackson compatibility, API compatibility, and required CI jobs all passed on the same SHA.

The prior Copilot finding applied to ae6c92bd, and the current module-local Bedrock alignment correctly resolves it without weakening Core or OkHttp compatibility coverage. No correctness, security, consumer-impact, or structural-maintainability findings. Approving.