Update jgit from 7.2.0 to 7.4.0

[mbien]

This updates jgit to latest (7.4) and its dependencies to the resolved version.

• https://projects.eclipse.org/projects/technology.jgit/releases/7.3.0
• https://projects.eclipse.org/projects/technology.jgit/releases/7.4.0
• https://www.cve.org/CVERecord?id=CVE-2025-4949

current jgit releases are not on maven central yet but the jgit team is working on it (eclipse-jgit/jgit#210). This adds the eclipse repo temporarily. done

classpath diffs

$ mvn eu.maveniverse.maven.plugins:toolbox:gav-classpath-diff -Dunified\
 -Dgav1=org.eclipse.jgit:org.eclipse.jgit:7.2.0.202503040940-r -Dgav2=org.eclipse.jgit:org.eclipse.jgit:7.4.0.202509020913-r 

*** org.eclipse.jgit:org.eclipse.jgit:jar 7.2.0.202503040940-r -> 7.4.0.202509020913-r
    com.googlecode.javaewah:JavaEWAH:jar:1.2.3
    org.slf4j:slf4j-api:jar:1.7.36
*** commons-codec:commons-codec:jar 1.18.0 -> 1.19.0

$ mvn eu.maveniverse.maven.plugins:toolbox:gav-classpath-diff -Dunified\
 -Dgav1=org.eclipse.jgit:org.eclipse.jgit.gpg.bc:7.2.0.202503040940-r -Dgav2=org.eclipse.jgit:org.eclipse.jgit.gpg.bc:7.4.0.202509020913-r

*** org.eclipse.jgit:org.eclipse.jgit.gpg.bc:jar 7.2.0.202503040940-r -> 7.4.0.202509020913-r
*** org.eclipse.jgit:org.eclipse.jgit:jar 7.2.0.202503040940-r -> 7.4.0.202509020913-r
    com.googlecode.javaewah:JavaEWAH:jar:1.2.3
*** commons-codec:commons-codec:jar 1.18.0 -> 1.19.0
*** org.bouncycastle:bcpg-jdk18on:jar 1.80 -> 1.81
*** org.bouncycastle:bcprov-jdk18on:jar 1.80 -> 1.81
*** org.bouncycastle:bcutil-jdk18on:jar 1.80 -> 1.81
*** org.bouncycastle:bcpkix-jdk18on:jar 1.80 -> 1.81
    org.slf4j:slf4j-api:jar:1.7.36

$ mvn eu.maveniverse.maven.plugins:toolbox:gav-classpath-diff -Dunified\
 -Dgav1=org.eclipse.jgit:org.eclipse.jgit.ssh.jsch:7.2.0.202503040940-r -Dgav2=org.eclipse.jgit:org.eclipse.jgit.ssh.jsch:7.4.0.202509020913-r

*** org.eclipse.jgit:org.eclipse.jgit.ssh.jsch:jar 7.2.0.202503040940-r -> 7.4.0.202509020913-r
*** org.eclipse.jgit:org.eclipse.jgit:jar 7.2.0.202503040940-r -> 7.4.0.202509020913-r
    com.googlecode.javaewah:JavaEWAH:jar:1.2.3
*** commons-codec:commons-codec:jar 1.18.0 -> 1.19.0
    com.jcraft:jsch:jar:0.1.55
    com.jcraft:jzlib:jar:1.1.3
    org.slf4j:slf4j-api:jar:1.7.36

$ mvn eu.maveniverse.maven.plugins:toolbox:gav-classpath-diff -Dunified\
 -Dgav1=org.eclipse.jgit:org.eclipse.jgit.lfs:7.2.0.202503040940-r -Dgav2=org.eclipse.jgit:org.eclipse.jgit.lfs:7.4.0.202509020913-r

*** org.eclipse.jgit:org.eclipse.jgit.lfs:jar 7.2.0.202503040940-r -> 7.4.0.202509020913-r
*** org.eclipse.jgit:org.eclipse.jgit:jar 7.2.0.202503040940-r -> 7.4.0.202509020913-r
    com.googlecode.javaewah:JavaEWAH:jar:1.2.3
    org.slf4j:slf4j-api:jar:1.7.36
*** commons-codec:commons-codec:jar 1.18.0 -> 1.19.0
*** com.google.code.gson:gson:jar 2.12.1 -> 2.13.1
*** com.google.errorprone:error_prone_annotations:jar 2.36.0 -> 2.38.0

thanks to @cstamas for the awesome classpath diff tool. This made this much easier than in past.

last update for reference #8383

[mbien]

oh right I forgot about that (#7569). bouncycaste can't be updated still

    [junit] WARNING [org.netbeans.core.netigso.Netigso]: Cannot fake bcprov
    [junit] org.osgi.framework.BundleException: Invalid manifest header Import-Package: "java.io;resolution:="optional"" : Cannot specify java.* packages in Import/Export headers "java.io"
    [junit] 	at org.eclipse.osgi.internal.resolver.StateBuilder.checkImportExportSyntax(StateBuilder.java:824)
    [junit] 	at org.eclipse.osgi.internal.resolver.StateBuilder.validateHeaders(StateBuilder.java:212)

edit: reverted it here and parked the bouncycastle commit in a branch https://github.com/mbien/netbeans/commits/bc182/
edit2: opened issue #8894

[mbien]

jgit update is likely not possible with the bouncycastle dependency locked to 1.77.

I ran jgit tests locally with downgraded dependency:

diff --git a/pom.xml b/pom.xml
index 14cfa2405..f1a8b742c 100644
--- a/pom.xml
+++ b/pom.xml
@@ -137,7 +137,7 @@
     <slf4j-version>1.7.36</slf4j-version>
     <maven-javadoc-plugin-version>3.11.2</maven-javadoc-plugin-version>
     <gson-version>2.13.1</gson-version>
-    <bouncycastle-version>1.81</bouncycastle-version>
+    <bouncycastle-version>1.77</bouncycastle-version>
     <spotbugs-maven-plugin-version>4.9.3.0</spotbugs-maven-plugin-version>
     <maven-project-info-reports-plugin-version>3.9.0</maven-project-info-reports-plugin-version>
     <maven-jxr-plugin-version>3.6.0</maven-jxr-plugin-version>

git checkout v7.4.0.202509020913-r
mvn clean verify

failed with

[ERROR] Failed to execute goal org.apache.maven.plugins:maven-compiler-plugin:3.14.0:compile (default-compile) on project org.eclipse.jgit.gpg.bc: Compilation failure: Compilation failure:
[ERROR] /home/mbien/NetBeansProjects/jgit/org.eclipse.jgit.gpg.bc/src/org/eclipse/jgit/gpg/bc/internal/BouncyCastleGpgSigner.java:[105,47] The constructor org.bouncycastle.openpgp.PGPSignatureGenerator(org.bouncycastle.openpgp.operator.jcajce.JcaPGPContentSignerBuilder, org.bouncycastle.openpgp.PGPPublicKey) is undefined
[ERROR] /home/mbien/NetBeansProjects/jgit/org.eclipse.jgit.gpg.bc/src/org/eclipse/jgit/gpg/bc/internal/keys/SecretKeys.java:[149,22] ProtectionFormatTypeTags cannot be resolved or is not a field
[ERROR] /home/mbien/NetBeansProjects/jgit/org.eclipse.jgit.gpg.bc/src/org/eclipse/jgit/gpg/bc/internal/keys/SecretKeys.java:[150,6] The method getProtectionType(java.lang.String) is undefined for the type org.bouncycastle.gpg.SExprParser

converting to draft, dropping milestone