### Fixed
- `<licenseHeader>` with `<yearMode>SET_FROM_GIT</yearMode>` no longer runs `git log` through a shell, eliminating a shell-injection vector when formatting files whose names contain shell metacharacters.
- Bump transitive `plexus-utils` `4.0.2` -> `4.0.3` to address [CVE-2025-67030](GHSA-6fmv-xxpf-w3cw). ([#2919](#2919))

### Fixed
- `LicenseHeaderStep` in `SET_FROM_GIT` year mode no longer invokes `git log` through `bash -c` / `cmd /c`, eliminating a shell-injection vector when processing repositories that contain files whose names include shell metacharacters.

### Fixed
- `licenseHeader` with `setLicenseHeaderYearsFromGitHistory()` no longer runs `git log` through a shell, eliminating a shell-injection vector when formatting files whose names contain shell metacharacters.

### Added
- `<scalafmt>` now reads the version from the `version` field in the scalafmt config file when no `<version>` is explicitly set, falling back to the built-in default only if neither is available. ([#2922](#2922))
- Add `<toml>` format type with `<versionCatalog>` step for formatting and sorting Gradle version catalog files. ([#2916](#2916))
- Add `<javaparserVersion>` option to `<cleanthat>`, allowing users to override the JavaParser version pulled in transitively by Cleanthat. ([#2903](#2903))
- Add a `expandWildcardImports` API for java ([#2829](#2930))
### Fixed
- Preserve case of JDBI named bind params that collide with SQL keywords (e.g. `:limit`, `:offset`) in the DBeaver SQL formatter. ([#2899](#2899))
- The `-Dspotless.ratchetFrom=...` user property now takes priority over `<ratchetFrom>` configured in the plugin or in individual formatters, instead of being overridden by them. ([#2896](#2896), fixes [#2842](#2842))
- Fix non-idempotent formatting when `importOrder()` is combined with `greclipse()`: a single catch-all group no longer strips blank lines that `greclipse()` independently inserted between import groups. ([#2914](#2914))
### Changes
- Fix `expandWildcardImports` failing on JDK XML types such as `org.xml.sax.InputSource`. ([#2921](#2921))
- Use Eclipse JDT's collator-based comparison when sorting Java members to better match Eclipse save actions. ([#2920](#2920))
- Bump default `cleanthat` version `2.24` -> `2.25`. ([#2903](#2903))
- Bump default `eclipse-jdt` version from `4.35` to `4.39`. ([#2912](#2912))

### Added
- `scalafmt()` now reads the version from the `version` field in the scalafmt config file when no version is explicitly set in the plugin config, falling back to the built-in default only if neither is available. ([#2922](#2922))
- Add `versionCatalog` step for formatting and sorting Gradle version catalog (`.toml`) files. ([#2916](#2916))
- Add `javaparserVersion` option to the Cleanthat step, allowing callers to override the JavaParser version pulled in transitively by Cleanthat. ([#2903](#2903))
### Fixed
- Preserve case of JDBI named bind params that collide with SQL keywords (e.g. `:limit`, `:offset`) in the DBeaver SQL formatter. ([#2899](#2899))
- Fix non-idempotent formatting when `importOrder()` is combined with `greclipse()`: a single catch-all group no longer strips blank lines that `greclipse()` independently inserted between import groups. ([#2914](#2914))
### Changes
- Fix `expandWildcardImports` failing on JDK XML types such as `org.xml.sax.InputSource`. ([#2921](#2921))
- Use Eclipse JDT's collator-based comparison when sorting Java members to better match Eclipse save actions. ([#2920](#2920))
- Bump default `cleanthat` version `2.24` -> `2.25`. ([#2903](#2903))
- Bump default `eclipse-jdt` version from `4.35` to `4.39`. ([#2912](#2912))

### Added
- `scalafmt()` now reads the version from the `version` field in the scalafmt config file when no version is explicitly set in the plugin config, falling back to the built-in default only if neither is available. ([#2922](#2922))
- Add `toml` format type with `versionCatalog()` step for formatting and sorting Gradle version catalog files. ([#2916](#2916))
- Add `withIndentStyle` and `withIndentSize` configuration to `tableTestFormatter` for setting the fallback indent when no `.editorconfig` is found. ([#2893](#2893))
- Add `javaparserVersion(...)` to `cleanthat`, allowing users to override the JavaParser version pulled in transitively by Cleanthat. ([#2903](#2903))
### Fixed
- Fix `tableTestFormatter` editorconfig cache not honoring `.editorconfig` changes across Gradle daemon runs due to a shared static `EditorConfigProvider`. ([#2893](#2893))
- Preserve case of JDBI named bind params that collide with SQL keywords (e.g. `:limit`, `:offset`) in the DBeaver SQL formatter. ([#2899](#2899))
- Fix non-idempotent formatting when `importOrder()` is combined with `greclipse()`: a single catch-all group no longer strips blank lines that `greclipse()` independently inserted between import groups. ([#2914](#2914))
- Fix `predeclareDepsFromBuildscript()` on Gradle 9 by avoiding mutation of the root buildscript configuration container. ([#2929](#2929), fixes [#2599](#2599))
### Changes
- Fix `expandWildcardImports` failing on JDK XML types such as `org.xml.sax.InputSource`. ([#2921](#2921))
- Use Eclipse JDT's collator-based comparison when sorting Java members to better match Eclipse save actions. ([#2920](#2920))
- Bump default `cleanthat` version `2.24` -> `2.25`. ([#2903](#2903))
- Bump default `eclipse-jdt` version from `4.35` to `4.39`. ([#2912](#2912))
- Make `spotlessPredeclare` visible to Gradle Kotlin DSL type-safe accessors. ([#2925](#2925))
- Allow `spotlessPredeclare` to be used directly without enabling it first in spotless extension. ([#2925](#2925))

### Added
- Add `tableTest` format type for standalone `.table` files. ([#2880](#2880))
### Changes
- Bump default `tabletest-formatter` version `1.0.1` -> `1.1.1`, now works with Java 17+. ([#2880](#2880))

### Added
- Add `tableTest` format type for standalone `.table` files. ([#2880](#2880))
### Changes
- Bump default `tabletest-formatter` version `1.0.1` -> `1.1.1`, now works with Java 17+. ([#2880](#2880))

### Added
- Add `tableTest` format type for standalone `.table` files. ([#2880](#2880))
### Fixed
- Fix illegal mutation when using predeclared dependencies. ([#2892](#2892))
### Changes
- Bump default `tabletest-formatter` version `1.0.1` -> `1.1.1`, now works with Java 17+. ([#2880](#2880))

### Added
- Add `tabletest-formatter` support for Java and Kotlin. ([#2860](#2860))
### Fixed
- Fix the ability to specify a wildcard version (`*`) for external formatter executables, which did not work. ([#2848](#2848))
- [fix] `ConcurrentModificationException` in `expandWildcardImports` ([#2830](#2830))