[timtebeek]

Seven jars sat on the test runtime classpath only so that JavaParser.classpath(...) / KotlinParser.classpath(...) lookups could resolve types while parsing test sources. Nothing in the tests imports or runs them, but they still bring CVE exposure and remediation churn: javafaker 1.0.2 is unmaintained and depends on snakeyaml 1.x (only kept off the classpath by an exclusion), archunit 0.23.1 and hamcrest 1.3 are old, and javafaker, datafaker, arquillian-junit-core and testng floated on latest.release.

These are now testParserClasspath entries in the test type table, so nothing extra ships in the published recipe jar:

• org.hamcrest:hamcrest-core:1.3 and org.hamcrest:hamcrest-library:1.3
• com.tngtech.archunit:archunit:0.23.1
• com.github.javafaker:javafaker:1.0.2
• net.datafaker:datafaker:2.+ (resolves to 2.7.0, the version the tests ran against)
• org.jboss.arquillian.junit:arquillian-junit-core:1.10.2.Final
• org.mockito.kotlin:mockito-kotlin:5.4.0 (KotlinParser.Builder supports classpathFromResources, so CleanupMockitoImportsTest now uses "mockito-core-5", "mockito-kotlin-5")

org.testng:testng was removed outright. Nothing runs TestNG; every lookup already went through the existing testng-7 main type table entry.

Table lookups are prefix matches over artifactId-version, so the names are version-qualified (hamcrest-core-1.3, hamcrest-library-1.3, javafaker-1, datafaker-2, arquillian-junit-core-1, assertj-core-3). Because hamcrest-core-1.3 and hamcrest-library-1.3 now sit beside hamcrest-3.0, the two existing bare "hamcrest" lookups in AddHamcrestIfUsedTest and AddHamcrestJUnitDependencyTest became ambiguous; they now say "hamcrest-3", which is what they already resolved to. Regenerating the test table also moved grpc-testing from 1.84.0 to 1.85.1 through its existing 1.+ declaration. No recipe code changed.

Verified locally with ./gradlew test --continue, run on main and on this branch with the same settings. Both ran 2392 tests with 9 skipped and identical per-test outcomes. Both had the same 3 failures (AssertToAssertionsTest x2 and JUnit5MigrationTest.extendsAssertWithUnqualifiedAssertions): static imports come out as qualified Assertions. calls. Unchanged main fails the same way against the current rewrite snapshots, so this change didn't cause them. An earlier run on main against older snapshots passed all 2392. dependencies --configuration testRuntimeClasspath no longer lists any of the removed jars, and no transitive copies of them remain.