<!-- CURSOR_SUMMARY -->
> [!NOTE]
> **Medium Risk**
> Moderate risk because it changes the Nexus publishing configuration
used for releases/snapshots; incorrect endpoints could break publishing
but does not affect runtime code.
> 
> **Overview**
> Updates Gradle `nexusPublishing` configuration to stop using the
default `sonatype()` shorthand and instead explicitly set the new
Sonatype Central staging (`nexusUrl`) and snapshot
(`snapshotRepositoryUrl`) endpoints, with the existing timeout
preserved.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
ac10dd3. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

<!-- CURSOR_SUMMARY -->
> [!NOTE]
> **Low Risk**
> Low risk workflow-only change that just points secret retrieval at new
SSM parameter names; main risk is failed releases if the new parameters
are missing/misnamed.
> 
> **Overview**
> Updates the `publish.yml` GitHub Actions workflow to fetch Sonatype
credentials from the new SSM paths under
`.../sonatype/central/{username,password}` instead of the previous
`.../sonatype/{username,password}` parameters, leaving the rest of the
publish process unchanged.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
eeab9b9. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

## Summary

Pin all third-party GitHub Actions to full-length commit SHAs to prevent
supply chain attacks.

Addresses findings from the
[`third-party-action-not-pinned-to-commit-sha`](https://github.com/launchdarkly/semgrep-rules/blob/main/github-actions/third-party-action-not-pinned-to-commit-sha.yml)
Semgrep rule.

## Test plan

- [ ] Verify CI passes with pinned action SHAs

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Low risk: only changes the workflow action reference to a specific
commit, reducing supply-chain risk without altering release logic.
> 
> **Overview**
> Pins the `google-github-actions/release-please-action` used in
`.github/workflows/release-please.yml` from the floating `@v4` tag to a
specific commit SHA (`v4.4.0`) to improve workflow supply-chain
security.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
70e2919. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: Ryan Lamb <4955475+kinyoklion@users.noreply.github.com>

<!-- CURSOR_SUMMARY -->
> [!NOTE]
> **Low Risk**
> Removes an unused GitHub Actions permission; behavior should be
unchanged aside from reduced token scope.
> 
> **Overview**
> Tightens the `publish-docs` GitHub Actions workflow by removing the
`id-token: read` permission (no OIDC usage), leaving only `contents:
write` for publishing documentation to GitHub Pages.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
e488ca4. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

## Summary

Adds `permissions: pull-requests: read` at the workflow level in
`.github/workflows/lint-pr-title.yml`.

The reusable workflow at
`launchdarkly/gh-actions/.github/workflows/lint-pr-title.yml@main` was
updated (launchdarkly/gh-actions#86) to declare `permissions:
pull-requests: read` at the job level. A reusable workflow can only
request a subset of the permissions the caller grants, so without an
explicit `permissions` block in the caller, every run hits
`startup_failure`. Same fix as launchdarkly/sdk-meta#429.

## Review & Testing Checklist for Human

- [ ] Verify the `Lint PR title` check on this PR exits `success` rather
than `startup_failure`

### Notes

No product code is changed — workflow-only permissions fix being applied
across SDK repos that use the reusable `lint-pr-title` workflow.

Link to Devin session:
https://app.devin.ai/sessions/c7b96da5c9074500aa684bc9a9ba1c31
Requested by: @kinyoklion

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Low risk: only adjusts GitHub Actions workflow permissions and does
not touch product code. The main impact is whether the PR-title lint job
can start and access PR metadata as intended.
> 
> **Overview**
> Updates the `Lint PR title` GitHub Actions workflow to explicitly
grant `pull-requests: read` permissions at the workflow level.
> 
> This aligns caller permissions with the reusable
`launchdarkly/gh-actions` lint workflow so runs don’t fail at startup
due to insufficient PR access.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
769ec7c. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

…action to v5 (#49)

## Summary
Fixes Release Please `startup_failure` by adding explicit `permissions`
to the `call-workflow-publish` caller job. Also migrates from archived
`google-github-actions/release-please-action` to
`googleapis/release-please-action` v5.

## Review & Testing Checklist for Human
- [ ] Verify the release-please workflow runs without startup_failure on
next push to main
- [ ] Confirm the migration from google-github-actions to googleapis
doesn't change behavior

### Notes
Same fix pattern as dotnet-core PR #241. The
`google-github-actions/release-please-action` repo is archived;
`googleapis/release-please-action` is the active successor.

Link to Devin session:
https://app.devin.ai/sessions/54e32482848742c19ebf9c374efdc833
Requested by: @kinyoklion

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Low risk CI-only change; it updates the Release Please GitHub Action
and adds explicit job permissions for the reusable publish workflow,
which could affect release automation if misconfigured.
> 
> **Overview**
> Updates the Release Please workflow to use the maintained
`googleapis/release-please-action` at v5.
> 
> Adds explicit `id-token` and `contents` permissions to the
`call-workflow-publish` reusable-workflow caller job to avoid
permission-related startup failures when publishing after a release is
created.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
22887ce. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

## Summary

Updates `SECURITY.md` to direct security reporters to LaunchDarkly's Bug
Bounty program.

## Changes

- Security issues should be reported through the [Bug Bounty
program](https://bugcrowd.com/engagements/launchdarkly-mbb-og) rather
than via GitHub Issues or PRs
- Clarifies that valid security issues may be eligible for a bounty

This is a cross-repository update to standardize security reporting
instructions across LaunchDarkly repositories.

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Documentation-only change to security reporting instructions; no
application or infrastructure code is modified.
> 
> **Overview**
> **`SECURITY.md`** is updated so security reporting matches
LaunchDarkly’s current process across repos.
> 
> The doc now **boldly warns** not to file GitHub Issues or PRs for
vulnerabilities, with clearer rationale about public exposure. Reporting
is directed to the **Bugcrowd** [Bug Bounty
program](https://bugcrowd.com/engagements/launchdarkly-mbb-og) instead
of the previous **HackerOne** link, and a line is added asking reporters
**not to contact LaunchDarkly staff directly**.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
acf7941. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

…0 compatibility (#52)

**Requirements**

- [x] I have added test coverage for new or changed functionality
- [x] I have followed the repository's [pull request submission
guidelines](../blob/main/CONTRIBUTING.md#submitting-pull-requests)
- [x] I have validated my changes against all supported platform
versions

**Related issues**

OpenFeature Java SDK 1.21.0 changed `ProviderEvaluationBuilder` from
having 1 type parameter to 3 (adopting Lombok's `@SuperBuilder`
pattern). This causes a compilation failure since the provider declares
the builder with an explicit single-parameter type.

**Describe the solution you've provided**

```diff
- ProviderEvaluation.ProviderEvaluationBuilder<T> builder = ProviderEvaluation.<T>builder()
+ var builder = ProviderEvaluation.<T>builder()
```

Using `var` lets the compiler infer the correct builder type regardless
of the OpenFeature SDK version. The `var` keyword is already used
elsewhere in the codebase (e.g., `Provider.java`). All 43 existing tests
pass with this change against OpenFeature SDK 1.21.0.

**Describe alternatives you've considered**

- Explicitly using `ProviderEvaluation.ProviderEvaluationBuilder<T, ?,
?>` — works but couples the code to the new 3-param signature and
wouldn't compile against older SDK versions.

**Additional context**

Versions tested: OpenFeature SDK 1.21.0, LaunchDarkly Java Server SDK
7.14.0. The version constraint `[1.16.0,2.0.0)` was already compatible —
only the source code needed updating.

Link to Devin session:
https://app.devin.ai/sessions/4c170c73c83d42e59b487f8b6fd21cc2
Requested by: @kinyoklion

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Single-line typing change in evaluation detail conversion; no runtime
logic changes.
> 
> **Overview**
> Fixes a **compile break** with OpenFeature Java SDK **1.21.0**, where
`ProviderEvaluationBuilder` gained extra type parameters.
> 
> In `EvaluationDetailConverter.getProviderEvaluation`, the local
builder is now declared with **`var`** instead of
`ProviderEvaluation.ProviderEvaluationBuilder<T>`, so the compiler picks
the right builder type across SDK versions. **Evaluation mapping
behavior is unchanged** (value, reason, error code, variant).
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
b6a562e. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

🤖 I have created a release *beep* *boop*
---


##
[1.1.3](1.1.2...1.1.3)
(2026-06-29)


### Bug Fixes

* update ProviderEvaluationBuilder usage for OpenFeature SDK 1.21.0
compatibility
([#52](#52))
([4350abe](4350abe))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Version and changelog-only release automation with no runtime code
changes in the diff.
> 
> **Overview**
> **Release 1.1.3** — bumps the published version from **1.1.2** to
**1.1.3** in `gradle.properties` and `.release-please-manifest.json`,
and adds the **1.1.3** section to `CHANGELOG.md`.
> 
> The changelog records the shipped fix from
[#52](#52):
updating **`ProviderEvaluationBuilder`** usage for compatibility with
**OpenFeature SDK 1.21.0**. This PR does not include that code
change—only the Release Please version and release notes.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
1bbd8fd. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>