[devin-ai-integration]

Weekly sdk-examples sweep: refresh the exact action pins in the build-and-run workflow, and make the JUnit dependency constraints float within their current major so routine patch/minor releases need no PR.

• actions/checkout v4 → v7, actions/setup-java v4 → v6 (ESM migration, not user-facing).
• launchdarkly/gh-actions/actions/release-secrets v1.1.0 → v1.2.1 and verify-hello-app v2.0.0 → v2.0.1.
• junit-jupiter-api / junit-jupiter-engine exact 5.14.4 → [5.14.4,6.0.0), matching the within-major range idiom already used for the three LaunchDarkly/OpenFeature deps in the same block. Floor preserved; resolves to 5.14.4 today.
• The SDK, provider and dev.openfeature:sdk deps already float within major ([7.0.0, 8.0.0), [1.0.0, 2.0.0), [1.2.0,2.0.0)) — unchanged. No lockfile in this repo.
• No source or README changes; documented Java minimum (11) intentionally left alone.

Implementation details

Not floated, deliberately: the com.gradleup.shadow plugin (8.3.11) and the Gradle wrapper (8.14.5) are build tooling rather than library dependencies, and the GitHub Actions pins are pinned by version/SHA on purpose for supply-chain reasons.

Version check (resolved via ./gradlew dependencies): launchdarkly-openfeature-serverprovider [1.0.0,2.0.0) → 1.2.1, launchdarkly-java-server-sdk [7.0.0,8.0.0) → 7.16.0 (latest 7.x), dev.openfeature:sdk [1.2.0,2.0.0) → 1.22.1, junit-jupiter-api [5.14.4,6.0.0) → 5.14.4 (latest 5.x; 6.x is a major bump).

Deprecated APIs: javac -Xlint:deprecation,removal against the resolved runtime classpath produced no warnings.

Action bumps verified for input compatibility: release-secrets v1.2.1 keeps the same aws_assume_role / ssm_parameter_pairs inputs (it only replaced the third-party SSM action with an in-repo node script and pinned configure-aws-credentials); verify-hello-app v2.0.1 keeps the same command / role_arn / use_server_key inputs.

Testing: on Java 17 locally, ./gradlew assemble succeeded and ./gradlew test is NO-SOURCE (no test sources in the example). Both ./gradlew run and java -jar build/libs/hello-openfeature-java-server-1.0-SNAPSHOT-all.jar with the hello-apps server key and LAUNCHDARKLY_FLAG_KEY=hello-boolean printed SDK successfully initialized! and The hello-boolean feature flag evaluates to true. Repo CI exercises the same workflow being changed here.

Link to Devin session: https://app.devin.ai/sessions/40f4a71c09614dc28e1a6fa4835e6da7
Open in Devin Desktop: https://app.devin.ai/desktop/session/40f4a71c09614dc28e1a6fa4835e6da7?variant=devin

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

@cursor review

[devin-ai-integration]

@cursor review