build: bump the gradle-dependencies group across 1 directory with 9 updates

gradle/libs.versions.toml

@@ -13,8 +13,8 @@ commons-cli = "1.11.0"
 pdfbox = "3.0.7"
 slf4j = "2.0.18"
 junit = "6.1.0"
-errorprone = "2.49.0"
-nullaway = "0.13.6"
+errorprone = "2.50.0"
+nullaway = "0.13.7"
 jspecify = "1.0.0"
 archunit = "1.4.2"
 # google-java-format: was inlined in despeckle's quality script and pinned in register's catalog;
@@ -31,9 +31,9 @@ system-stubs = "2.1.8"
 awaitility = "4.3.0"
 
 # --- Plugin marker versions (read by build-logic/build.gradle.kts and by `version.ref` below) ---
-spotless = "8.6.0"
+spotless = "8.7.0"
 errorprone-plugin = "5.1.0"
-spotbugs-plugin = "6.5.5"
+spotbugs-plugin = "6.5.8"
 # SpotBugs analysis-engine version (distinct from the Gradle plugin marker above); was inlined in
 # tate-yoko-pdf's quality script. The unified quality convention sets spotbugs.toolVersion from here.
 spotbugs-tool = "4.9.6"
@@ -43,16 +43,16 @@ shadow = "9.4.2"
 # Spring Boot Gradle plugin (bootRun/bootJar) for the :webapp:app web front end. Boot 4.0 (Spring
 # Framework 7) baselines Java 17 with first-class Java 25 support. Applied only in :webapp:app via
 # `alias(libs.plugins.springBoot)`; it imports its own dependency BOM for spring-boot-starter-*.
-spring-boot = "4.0.6"
+spring-boot = "4.1.0"
 # springdoc-openapi (Swagger UI + /v3/api-docs) for the :webapp:app REST API. The 3.0.x line targets
 # Spring Boot 4 / Jackson 3 (2.8.x is the Boot 3 line). App-only dep; not BOM-managed by Spring Boot.
 springdoc = "3.0.3"
-rewrite-plugin = "7.34.0"
-rewrite-recipe-bom = "3.32.0"
+rewrite-plugin = "7.35.0"
+rewrite-recipe-bom = "3.33.0"
 # rewrite-java-security is the one recipe module not managed by the recipe BOM, so its version is
 # pinned here. Compatibility comes from it depending on the same rewrite-bom (rewrite-core) line as
 # the recipe BOM — verify that shared line on each bump; the matching 3.31.0 numbers are incidental.
-rewrite-java-security = "3.32.0"
+rewrite-java-security = "3.33.1"
 
 # PIT mutation testing. ADOPTED FROM DESPECKLE (camelCase leaves, NOT dashed). `pitest` is the PIT
 # analysis tool version; `pitestJunit5Plugin` is the JUnit 5 bridge. Both are single camelCase

gradle/wrapper/gradle-wrapper.properties

@@ -1,7 +1,7 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionSha256Sum=bafc141b619ad6350fd975fc903156dd5c151998cc8b058e8c1044ab5f7b031f
-distributionUrl=https\://services.gradle.org/distributions/gradle-9.5.1-bin.zip
+distributionSha256Sum=bbaeb2fef8710818cf0e261201dab964c572f92b942812df0c3620d62a529a01
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.6.0-bin.zip
 networkTimeout=10000
 retries=0
 retryBackOffMs=500