[cjbell]

Stacked on #40. This updates the build toolchain and every runtime and test dependency to current stable versions, so they ship with the 2.0.0 release. Published artifacts still target Java 8 (all classes are version 52).

Runtime dependencies (consumer-facing)

Dependency	Before	After
Jackson	2.18.2	2.22.3 (jackson-annotations 2.22)
OkHttp + logging-interceptor	4.12.0	5.5.0
Apache HttpClient / HttpCore	5.3.1 / 5.2.4	5.6.4 / 5.4.4
error_prone_annotations	2.33.0	2.50.0
kotlin-stdlib (published floor)	1.8.0	2.2.0

Notes:

• OkHttp is now declared as com.squareup.okhttp3:okhttp-jvm. OkHttp 5's okhttp artifact is an empty jar for Maven consumers, because Maven can't read Gradle module metadata.
• Jackson floor: the SDK still compiles and tests against 2.13.4 via the existing force(...) block. I also ran the suite once against 2.22.3 unpinned. Only the five ObjectMappersTest cases that the test itself documents as 2.13.4-only quirks failed (scalar-to-String coercion that 2.14+ correctly rejects).
• Kotlin: language and API version move from 1.8 to 2.2. Kotlin 2.4 dropped 1.8 support and deprecates anything below 2.2, and OkHttp 5 already ships Kotlin 2.1 metadata. Java consumers are unaffected. Kotlin consumers need the Kotlin 2.1 compiler or later.

Build toolchain

Tool	Before	After
Gradle	8.12	9.8.0
Kotlin Gradle plugin	1.9.20	2.4.20
Dokka	2.0.0 (V1 mode)	2.2.0 (V2, Javadoc format)
vanniktech maven-publish	0.28.0	0.37.0
Spotless	7.0.2	8.10.3

• Compiler warnings: the blanket -nowarn is gone. Deprecation warnings and the redundant toInt() diagnostic from generated validity() code are disabled individually, so the build is warning-free. Other warnings now show up.
• Dokka V2: V2 can't aggregate Javadoc across modules, so knock-java documents the core and OkHttp sources directly. The merged javadoc jar has 1,443 files, like the old dokkaJavadocCollector output. Dokka's build-only Jackson and jsoup are pinned to secure versions, as upstream Stainless SDKs do.
• Publishing: vanniktech 0.37 removes SonatypeHost; Central Portal is now the default. It also removes the in-memory signing properties, so signing is configured explicitly from the same GPG_* env vars. I checked publishToMavenLocal with a throwaway GPG key: every artifact is signed, and the POMs list the versions above.
• Spotless: ktfmt is pinned to 0.61, the version generated code is formatted with, so the upgrade causes no reformatting. Spotless 8's default ktfmt (0.64) would reformat 39 generated files.

Test dependencies

Dependency	Before	After
JUnit	5.9.3	6.1.3
junit-pioneer	1.9.1	2.3.0
WireMock	wiremock-jre8 2.35.2	wiremock-standalone 3.13.2
AssertJ	3.25.3	3.27.7
Mockito	5.14.2	5.24.0
mockito-kotlin	4.1.0	6.4.0

These need Java 17, so only the test source sets now compile for 17. They already ran on the JDK 21 toolchain. The standalone WireMock jar bundles its own Jackson, so tests keep running against the 2.13.4 floor.

CI

• actions/checkout v7 and actions/setup-java v6.
• gradle/actions/setup-gradle v6 replaces the deprecated gradle/gradle-build-action@v2.
• The publish job sets up JDK 21, the build toolchain version, instead of 17.

Docs

• README: the default Jackson version, the Kotlin requirement, and a stale OkHttp 3.x link.
• MIGRATION.md: a new "Dependency updates" section under 2.0.0.

Verification

• ./scripts/lint passes with no compiler warnings.
• ./scripts/test (Prism): 1,049 tests, 0 failures, 198 skipped, the same as the base branch.
• Live read-only smoke checks (10 GET calls with response validation on) pass against the real API on Jackson 2.22.3 and OkHttp 5.5.0.

One Gradle deprecation remains (Configuration.setVisible). It comes from inside the Dokka plugin, not our build scripts.