chore(deps): bump antlr4.version from 4.9.1 to 4.13.2

[dependabot]

Bumps antlr4.version from 4.9.1 to 4.13.2.
Updates org.antlr:antlr4-runtime from 4.9.1 to 4.13.2

Release notes

Sourced from org.antlr:antlr4-runtime's releases.

4.13.2

Minor updates release.

Pull requests grouped by target

cpp target

• [Cpp] Use target_include_dirs for cmake targets (target:cpp)
• Update C++ documentation to state that C++17 is required (comp:doc, target:cpp)

go target

• fix go-target.md, remove duplicate 'get' (comp:doc, target:go)

javascript target

• fix(javascript): fix types not being recognized for NodeNext module resolution (target:javascript)
• [Javascript] Fix broken package entrypoints (target:javascript, type:cleanup)

python3 target

• name 'state' conflict with Python3 runtime. (target:python3)

Contributors

• 1 items: njnobles
• 1 items: Andreas Buhr (andreasbuhr)
• 1 items: Eric Vergnaud (ericvergnaud)
• 1 items: Gökhan Kurt (KurtGokhan)
• 1 items: johannesheesterman
• 1 items: Alex Miller (Codex-)
• 1 items: GP4cK
• 1 items: Alessandro Gatti (agatti)
• 1 items: cyqw
• 1 items: css521 (css521)

4.13.1

Pull requests grouped by target

csharp target

• [[CSharp] Fix for #4386 -- change signatures for ReportAttemptingFullContext() and ReportContextSensitivity() to be identical to all other targets](antlr/antlr4#4399) (target:csharp, type:cleanup)

go target

• Move GetText(), SetText(), and String() from CommonToken to BaseToken (target:go, type:cleanup)
• Restore "Obtained from string" source name. (target:go, type:cleanup)
• fix: Fix very minor code issues spotted by goreportcard.com (target:go, type:cleanup)

java target

• Java: suppress this-escape warning introduced in JDK 21. (actions, target:java)

javascript target

• Adds default targets for babel configuration (target:javascript)
• fix dependabot warnings (target:javascript, type:cleanup)

swift target

... (truncated)

Commits

• cc82115 [maven-release-plugin] prepare release 4.13.2
• b91cecf Update 4.13.1 -> 4.13.2
• 35ff30d Update release docs to say 4.13.2; rebuild XPathLexers
• 2559349 fix(javascript): fix types not being recognized for NodeNext module resolutio...
• e8bf978 rule name 'state' conflict with Python runtime.
• 88a0c7a Support TypeScript bundler module resolution
• caf46b9 [Python3] Replace deprecated assertEquals() to fix py3.12 compat
• 17f3f5e Add include dirs direclty to cpp targets
• b3bb743 chore: fix error link
• 7d4cea9 Fix singleton memory leaks
• Additional commits viewable in compare view

Updates org.antlr:antlr4-maven-plugin from 4.9.1 to 4.13.2

Release notes

Sourced from org.antlr:antlr4-maven-plugin's releases.

4.13.2

Minor updates release.

Pull requests grouped by target

cpp target

• [Cpp] Use target_include_dirs for cmake targets (target:cpp)
• Update C++ documentation to state that C++17 is required (comp:doc, target:cpp)

go target

• fix go-target.md, remove duplicate 'get' (comp:doc, target:go)

javascript target

• fix(javascript): fix types not being recognized for NodeNext module resolution (target:javascript)
• [Javascript] Fix broken package entrypoints (target:javascript, type:cleanup)

python3 target

• name 'state' conflict with Python3 runtime. (target:python3)

Contributors

• 1 items: njnobles
• 1 items: Andreas Buhr (andreasbuhr)
• 1 items: Eric Vergnaud (ericvergnaud)
• 1 items: Gökhan Kurt (KurtGokhan)
• 1 items: johannesheesterman
• 1 items: Alex Miller (Codex-)
• 1 items: GP4cK
• 1 items: Alessandro Gatti (agatti)
• 1 items: cyqw
• 1 items: css521 (css521)

4.13.1

Pull requests grouped by target

csharp target

• [[CSharp] Fix for #4386 -- change signatures for ReportAttemptingFullContext() and ReportContextSensitivity() to be identical to all other targets](antlr/antlr4#4399) (target:csharp, type:cleanup)

go target

• Move GetText(), SetText(), and String() from CommonToken to BaseToken (target:go, type:cleanup)
• Restore "Obtained from string" source name. (target:go, type:cleanup)
• fix: Fix very minor code issues spotted by goreportcard.com (target:go, type:cleanup)

java target

• Java: suppress this-escape warning introduced in JDK 21. (actions, target:java)

javascript target

• Adds default targets for babel configuration (target:javascript)
• fix dependabot warnings (target:javascript, type:cleanup)

swift target

... (truncated)

Commits

• cc82115 [maven-release-plugin] prepare release 4.13.2
• b91cecf Update 4.13.1 -> 4.13.2
• 35ff30d Update release docs to say 4.13.2; rebuild XPathLexers
• 2559349 fix(javascript): fix types not being recognized for NodeNext module resolutio...
• e8bf978 rule name 'state' conflict with Python runtime.
• 88a0c7a Support TypeScript bundler module resolution
• caf46b9 [Python3] Replace deprecated assertEquals() to fix py3.12 compat
• 17f3f5e Add include dirs direclty to cpp targets
• b3bb743 chore: fix error link
• 7d4cea9 Fix singleton memory leaks
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[mergify]

🧪 CI Insights

Here's what we observed from your CI run for 0d5fa68.

🟢 All jobs passed!

But CI Insights is watching 👀

[lvca]

@robfrank I'm using the same version linked by Gremlin to avoid conflict.

[robfrank]

Closing this: the bump is not viable, and closing by hand is the deliberate remedy rather than an oversight.

Why Gremlin cannot move to ANTLR 4.13.2

gremlin-language 3.8.1 ships a Gremlin grammar parser generated by the ANTLR 4.9.1 tool (TinkerPop 3.8.1's parent pom declares antlr4.version 4.9.1). ANTLR 4.10 changed the serialized ATN format: the BASE_SERIALIZED_UUID field present in 4.9.1's ATNDeserializer does not exist at all in 4.13.2. A 4.13 runtime therefore cannot deserialize a parser generated by 4.9.1.

The ANTLR version on the Gremlin classpath is not ArcadeDB's choice; it is whatever TinkerPop generated its grammar with. That is the cause of the 13 failing checks here, and no amount of rebasing fixes it.

gremlin/pom.xml also pins antlr4-runtime as optional=true on purpose so it is bundled and relocated into the shaded uber-jar without being exported to Maven-coordinate consumers (see the comments on #5216 / #5217). That arrangement depends on the pinned 4.9.1.

Why there is no ignore rule for ANTLR

Unlike Groovy, which was handled by a config rule in #5534, antlr4.version is declared per-module with two opposed intents:

Module	Version	Intent
gremlin/pom.xml:45	4.9.1	frozen by TinkerPop, as above
engine/pom.xml:46	4.13.2	independently tracks the newest ANTLR for the engine's own grammar

Dependabot ignore rules match dependency coordinates, not modules or properties. Gremlin's frozen 4.9.1 sits below the engine's current 4.13.2, so any version range that blocked this PR would also cover the engine's version and silently freeze it. That would trade a little noise for the loss of a signal we actually want.

Closing by hand is the better tradeoff: Dependabot will not re-propose 4.13.2 for a PR that was closed, and will only open a new one when a genuinely newer ANTLR ships. 4.13.2 is currently the newest release, so that is roughly one PR every couple of years, and when it arrives it is a real signal for engine.

What would actually unlock this

A TinkerPop upgrade. When TinkerPop regenerates its grammar against a 4.10+ ANTLR, this bump becomes trivially mergeable. Tracking that against gremlin.version is more useful than a recurring PR here.

The reasoning is recorded as a comment in .github/dependabot.yml on main so it is not re-litigated.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.