Bump org.clojure:clojure from 1.11.1 to 1.12.5

[dependabot]

Bumps org.clojure:clojure from 1.11.1 to 1.12.5.

Changelog

Sourced from org.clojure:clojure's changelog.

Changes to Clojure in Version 1.12.5

• CLJ-2945 - reify - incorrectly transfers reader metadata to runtime object
• CLJ-2228 - constantly - unroll to remove rest args allocation

Changes to Clojure in Version 1.12.4

• CLJ-2924 - LazySeq - fix visibility issues with non-volatile reads

Changes to Clojure in Version 1.12.3

• CLJ-2919 - Compiler - fix nested compilation emitting for keyword and protocol call sites

Changes to Clojure in Version 1.12.2

• CLJ-2914 - Compiler - syntax error if qualified instance method expression is missing instance
• CLJ-1798 - Refs - avoid creating RetryEx in LockingTransaction on every transaction
• CLJ-2916 - LazySeq - realize before serializing and do not serialize IFn
• CLJ-2917 - Iterate - de/serialization no longer supported, throw

Changes to Clojure in Version 1.12.1

• CLJ-2899 - Revert change in semantics of qualified symbol in invocation position if field and method of same name
• CLJ-2898 - Objects that are both IFn and FunctionalInterface unnecessarily get converted to FI
• CLJ-2888 - gen-class - did not support new array class symbol syntax
• CLJ-2886 - add-libs - send only procurer keys to tool invocation
• CLJ-2906 - Add missing :added metadata to 1.12 functions

Changes to Clojure in Version 1.12.0

1 Compatibility

1.1 Java 8 - Compatiblity EOL notice

Clojure 1.12 produces Java 8 bytecode (same as Clojure 1.10 and 1.11), but this is expected to be the last release using a Java 8 baseline. Future releases will move the bytecode and minimum Java compatibility to a newer Java LTS release.

1.2 Java 21 - Virtual thread pinning from user code under synchronized

Clojure users want to use virtual threads on JDK 21. Prior to 1.12, Clojure lazy-seqs and delays, in order to enforce run-once behavior, ran user code under synchronized blocks, which as of JDK 21 don't yet participate in cooperative blocking. Thus if that code did e.g. blocking I/O it would pin a real thread. JDK 21 may emit warnings for this when using -Djdk.tracePinnedThreads=full.

To avoid this pinning, in 1.12 lazy-seq and delay use locks instead of synchronized blocks.

See: CLJ-2804

1.3 Security

Fix CVE-2024-22871 detailed in GHSA-vr64-r9qj-h27f:

• CLJ-2839 iterate, cycle, repeat - infinite seqs have infinite hashCode()

... (truncated)

Commits

• 3bc2b3e [maven-release-plugin] prepare release clojure-1.12.5
• 4dffbdb [maven-release-plugin] prepare for next development iteration
• 16d2152 [maven-release-plugin] prepare release clojure-1.12.5-rc1
• 51df024 [maven-release-plugin] prepare for next development iteration
• 4a99579 [maven-release-plugin] prepare release clojure-1.12.5-alpha1
• 9ad0b9a update changelog
• 9b85072 CLJ-2228 Improve performance of constantly
• 53d6a05 CLJ-2945: do not propagate file/line info to runtime reify obj
• a3fa897 Add permissions to github actions
• 35b68c5 Add Java 25 to testing matrix
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)