OF815 · pull · Nov 11, 2025 · Nov 11, 2025 · Nov 11, 2025 · Nov 11, 2025
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -0,0 +1,17 @@
+version: 2
+enable-beta-ecosystems: true
+updates:
+  # Bazel infrastructure dependencies (rules_java, bazel_skylib, etc.)
+  # Note: Beta only updates bazel_dep() declarations, not Maven artifacts
+  - package-ecosystem: "bazel"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+
+  # GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
diff --git a/.github/workflows/bazel-steward.yml b/.github/workflows/bazel-steward.yml
@@ -9,7 +9,7 @@ jobs:
   bazel-steward:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           fetch-depth: 0
       - uses: VirtusLab/bazel-steward@latest

diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
@@ -23,13 +23,13 @@ jobs:
     needs:
       - get_date
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: google-java-format cache
         uses: actions/cache@v4
         with:
           path: "~/.cache/google-java-format"
           key: google-java-format-${{ hashFiles('tools/fix_java_format.sh') }}
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@v5
         with:
           distribution: "temurin"
           java-version: "17"
@@ -38,9 +38,9 @@ jobs:
   json_template:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.10"
       - name: Install dependencies
@@ -50,13 +50,13 @@ jobs:
   checkstyle:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Checkstyle cache
         uses: actions/cache@v4
         with:
           path: "~/.cache/checkstyle"
           key: checkstyle-${{ hashFiles('tools/run_checkstyle.sh') }}
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@v5
         with:
           distribution: "temurin"
           java-version: "17"
@@ -67,7 +67,7 @@ jobs:
       - get_date
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Bazelisk cache
         uses: actions/cache@v4
         with:
@@ -81,7 +81,7 @@ jobs:
           restore-keys: |
             ${{runner.os}}-bazel-17-${{ hashFiles('.bazelversion', 'WORKSPACE', 'maven_install.json') }}-test-
             ${{runner.os}}-bazel-17-${{ hashFiles('.bazelversion', 'WORKSPACE', 'maven_install.json') }}-
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@v5
         with:
           distribution: "temurin"
           java-version: "17"
@@ -95,7 +95,7 @@ jobs:
           bazel build //projects/allinone:allinone_main_deploy.jar
           cp bazel-bin/projects/allinone/allinone_main_deploy.jar workspace/allinone.jar
       - name: Save JAR
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: allinone_jar_17
           path: workspace/allinone.jar
@@ -106,7 +106,7 @@ jobs:
       - get_date
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Bazelisk cache
         uses: actions/cache@v4
         with:
@@ -121,7 +121,7 @@ jobs:
             ${{runner.os}}-bazel-${{ hashFiles('.bazelversion', 'WORKSPACE', 'maven_install.json') }}-junit-
             ${{runner.os}}-bazel-${{ hashFiles('.bazelversion', 'WORKSPACE', 'maven_install.json') }}-
             ${{runner.os}}-bazel-
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@v5
         with:
           distribution: "temurin"
           java-version: "17"
@@ -133,7 +133,7 @@ jobs:
             --combined_report=lcov \
             --instrument_test_targets=false
       - name: Generate report
-        uses: codecov/codecov-action@v4
+        uses: codecov/codecov-action@v5
         env:
           CODECOV_TOKEN: ${{ secrets.BATFISH_CODECOV_TOKEN }}
         with:

diff --git a/MODULE.bazel b/MODULE.bazel
@@ -94,16 +94,16 @@ bazel_dep(name = "rules_license", version = "1.0.0")
 bazel_dep(name = "bazel_features", version = "1.38.0")
 
 # Java rules and dependencies
-bazel_dep(name = "rules_java", version = "8.16.1")
+bazel_dep(name = "rules_java", version = "9.0.3")
 bazel_dep(name = "rules_jvm_external", version = "6.9")
 
 # Python rules
-bazel_dep(name = "rules_python", version = "1.4.1")
+bazel_dep(name = "rules_python", version = "1.6.3")
 
 # Development tools
 bazel_dep(name = "buildifier_prebuilt", version = "8.2.1", dev_dependency = True)
 
-bazel_dep(name = "rules_shell", version = "0.4.0")
+bazel_dep(name = "rules_shell", version = "0.6.1")
 
 # Python toolchain
 python = use_extension("@rules_python//python/extensions:python.bzl", "python")

diff --git a/MODULE.bazel.lock b/MODULE.bazel.lock
diff --git a/projects/batfish/src/main/java/org/batfish/dataplane/traceroute/FlowTracer.java b/projects/batfish/src/main/java/org/batfish/dataplane/traceroute/FlowTracer.java
@@ -183,8 +183,7 @@ public Integer visitFibNextVrf(FibNextVrf fibNextVrf) {
 
       @Override
       public Integer visitFibNullRoute(FibNullRoute fibNullRoute) {
-        // guarantee type correctness
-        FibNullRoute.class.cast(_rhs);
+        FibNullRoute ignored = (FibNullRoute) _rhs;
         return 0;
       }
     }

diff --git a/projects/client/src/main/java/org/batfish/client/Client.java b/projects/client/src/main/java/org/batfish/client/Client.java
@@ -460,7 +460,7 @@ static void validateType(JsonNode value, Variable variable) throws BatfishExcept
           throw new BatfishException(
               String.format("A Batfish %s must be a JSON string", expectedType.getName()));
         }
-        Enum.valueOf(InterfaceType.class, value.textValue().toUpperCase());
+        InterfaceType ignored = Enum.valueOf(InterfaceType.class, value.textValue().toUpperCase());
         break;
       case INTERFACES_SPEC:
         if (!(value.isTextual())) {