maint: Prune verification metadata and update third-party versions

[tonygermano]

Release cleanup with no changes to dependency versions.

Prune unused entries from verification-metadata.xml

Regenerated gradle/verification-metadata.xml from a cold Gradle cache using the command in CONTRIBUTING.md:

  GRADLE_USER_HOME=$(mktemp -d) ./gradlew --write-verification-metadata sha256 build dist -PdisableSigning=true -Pcoverage=true                                                                                

The diff only removes lines (293). No checksum is added or changed, so this extends no new trust. What it removes:

• 37 components for versions the build no longer resolves, left behind by earlier bumps: Netty 4.1.119/4.1.136, Log4j 2.25.3/2.25.4, Derby 10.11.1.1 (rolled back in b457938), mssql-jdbc 8.4.1, JUnit 4.8.1, Jakarta Mail 1.6.7, PostgreSQL 42.7.8, commons-configuration2 2.13.0, older Jackson/JUnit BOMs and parent POMs, and javax.annotation-api 1.3.
• The .pom of six components that also publish Gradle module metadata: jackson-{annotations,databind,dataformat-cbor,dataformat-yaml,datatype-jsr310}:2.14.3 and rhino:1.7.13. Their .jar and .module entries remain. Gradle didn't read these POMs during the cold-cache build, and verify-metadata is on, so any metadata file the build reads but the file doesn't list fails the build.

Update stale versions in THIRD-PARTY-README.txt

Several libraries were bumped without updating server/docs/thirdparty/THIRD-PARTY-README.txt:

Library	Was	Now
Apache Log4j	2.25.3	2.26.1
Netty	4.1.119	4.1.137
Jakarta Mail API	1.6.7	1.6.8 (source link moved to the 1.6.8 tag)
PostgreSQL JDBC Driver	42.7.8	42.7.12

Every other version listed in the README matches gradle/libs.versions.toml.

🤖 Generated with Claude Code

[github-actions]

Test Results

127 files  ±0  127 suites  ±0   3m 41s ⏱️ + 1m 14s
727 tests ±0  727 ✅ ±0  0 💤 ±0  0 ❌ ±0 
817 runs  ±0  811 ✅ ±0  6 💤 ±0  0 ❌ ±0 

Results for commit 3f382ac. ± Comparison against base commit d9520f9.

♻️ This comment has been updated with latest results.

[gibson9583]

Dependency-check still requests the five Jackson POMs and Rhino POM removed here. A focused resolution test passes on the base, fails on this PR, and passes with those six checksums restored. Please retain those entries.

[tonygermano]

Dependency-check still requests the five Jackson POMs and Rhino POM removed here. A focused resolution test passes on the base, fails on this PR, and passes with those six checksums restored. Please retain those entries.

@gibson9583 I think I'm going to leave it for now. The dependencyCheck task looks like it was an attempt to carry over something from ant that never worked. We don't have an API key for it, and it doesn't run in CI. I tried running it manually, but it warns that it will be very slow without the API key, and I killed it after 13 minutes with no clue how far it got into the process. The renovate updates don't include the pom files that it needs, and the command in the CONTRIBUTING guide to update verification-metadata doesn't add them either.

Whether we clean things up so we can use it or we get rid of it, I think I'd prefer to save that for a future PR.

[gibson9583]

Dependency-check still requests the five Jackson POMs and Rhino POM removed here. A focused resolution test passes on the base, fails on this PR, and passes with those six checksums restored. Please retain those entries.

@gibson9583 I think I'm going to leave it for now. The dependencyCheck task looks like it was an attempt to carry over something from ant that never worked. We don't have an API key for it, and it doesn't run in CI. I tried running it manually, but it warns that it will be very slow without the API key, and I killed it after 13 minutes with no clue how far it got into the process. The renovate updates don't include the pom files that it needs, and the command in the CONTRIBUTING guide to update verification-metadata doesn't add them either.

Whether we clean things up so we can use it or we get rid of it, I think I'd prefer to save that for a future PR.

I'm good with that

[pacmano1]

README, three more stale versions and one we don't ship:

• Java Common Annotations API 1.3: ships 1.3.2 (why this PR can prune 1.3)
• SOAP with Attachment API for Java Impl 1.0: saaj-impl is 1.4.0
• JAXB TXW Runtime 2.4.0-b180725.0427: txw2 follows jaxb-ri, 2.4.0-b180725.0644
• the JUnit 4.8.1 license section: nothing ships JUnit any more (the tests fetch 4.13.1 at build time), so the section can go

[tonygermano]

The changes @pacmano1 requested have been added to the second commit

[NicoPiel]

nb: One small inconsistency: the TXW Runtime source link still points to tree/master/jaxb-ri/txw, while the jaxb-ri entry above it points to the version tag.

[NicoPiel]

lgtm