Skip to content

Bump the project-dependencies group across 1 directory with 21 updates - #577

Merged
mmwinther merged 4 commits into
mainfrom
dependabot/gradle/project-dependencies-d0c2661a17
Sep 15, 2026
Merged

Bump the project-dependencies group across 1 directory with 21 updates#577
mmwinther merged 4 commits into
mainfrom
dependabot/gradle/project-dependencies-d0c2661a17

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 8, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the project-dependencies group with 21 updates in the / directory:

Package From To
org.codehaus.plexus:plexus-utils 4.0.3 4.1.0
org.apache.commons:commons-lang3 3.18.0 3.20.0
commons-codec:commons-codec 1.13 1.22.1
tools.jackson.core:jackson-databind 3.1.5 3.2.2
gradle-wrapper 9.6.0 9.7.1
org.json:json 20260522 20260814
org.junit.jupiter:junit-jupiter-params 6.1.0 6.1.3
org.jetbrains.kotlin:kotlin-reflect 2.4.0 2.4.10
org.jetbrains.kotlin:kotlin-stdlib-jdk8 2.4.0 2.4.10
org.jetbrains.kotlin.plugin.allopen 2.4.0 2.4.10
org.jetbrains.kotlin.jvm 2.4.0 2.4.10
ch.qos.logback:logback-classic 1.5.34 1.6.3
io.micronaut.platform:micronaut-platform 5.0.2 5.1.3
io.viascom.nanoid:nanoid 1.0.1 2.0.1
io.projectreactor:reactor-core 3.8.6 3.8.7
org.yaml:snakeyaml 2.6 2.7
com.google.devtools.ksp 2.3.9 2.3.11
io.micronaut.aot 5.0.0 5.0.2
io.micronaut.application 5.0.0 5.0.2
io.micronaut.test-resources 5.0.0 5.0.2
com.gradleup.shadow 9.4.2 9.6.1

Updates org.codehaus.plexus:plexus-utils from 4.0.3 to 4.1.0

Release notes

Sourced from org.codehaus.plexus:plexus-utils's releases.

4.1.0

DirectoryScanner no longer excludes .gitignore and .cvsignore by default. Code that relied on the old defaults has to add the two patterns explicitly. That change is what makes this a minor release rather than 4.0.4.

💥 Breaking changes

  • Do not exclude ".gitignore" and ".cvsignore" by default (#326) @​kwin

👻 Maintenance

🔧 Build

📦 Dependency updates

Commits
  • 572ce90 [maven-release-plugin] prepare release plexus-utils-4.1.0
  • 077e801 Bump the plexus dependencies released today
  • 840a1b4 Update parent to plexus 27
  • 9c560fa Drop the Publish Site workflow
  • 5f96b03 Bump org.codehaus.plexus:plexus from 25 to 26
  • 4846c05 Add the Publish Site workflow
  • 4df3a86 Use the shared release-drafter config instead of a local copy
  • 9eb5fc6 Apply spotless formatting to README
  • f2856f9 Rewrite README with usage, status and version guidance
  • 62fe2fa Bump release-drafter/release-drafter from 7.6.0 to 7.7.0
  • Additional commits viewable in compare view

Updates org.apache.commons:commons-lang3 from 3.18.0 to 3.20.0

Updates commons-codec:commons-codec from 1.13 to 1.22.1

Changelog

Sourced from commons-codec:commons-codec's changelog.

Apache Commons Codec 1.22.1 Release Notes

The Apache Commons Codec team is pleased to announce the release of Apache Commons Codec 1.22.1.

The Apache Commons Codec component contains encoders and decoders for formats such as Base16, Base32, Base64, digest, and Hexadecimal. In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities.

This is a feature and maintenance release. Java 8 or later is required.

Fixed Bugs

  • CODEC-344: Base64.Builder.setEncodeTable(byte...) accepts invalid custom alphabets. Thanks to Ruiqi Dong, Gary Gregory.
  • CODEC-340: Base58.Builder.setEncodeTable(byte...) is ignored when encoding and decoding. Thanks to Ruiqi Dong, Gary Gregory.
  • CODEC-342: Base32.Builder.setEncodeTable(byte...) can create a codec that cannot decode its own output. Thanks to Ruiqi Dong, Gary Gregory.
  • CODEC-343: Base32.Builder.setHexDecodeTable(boolean) sets the encode table to a decode lookup table. Thanks to Ruiqi Dong, Gary Gregory.
  • CODEC-341: Base16.Builder.setEncodeTable(byte...) can create a codec that cannot decode its own output. Thanks to Ruiqi Dong, Gary Gregory.
  • CODEC-339: URLCodec.encodeUrl(BitSet, byte[]) allows custom safe sets to emit URL encoding control characters. Thanks to Ruiqi Dong, Gary Gregory.
  • CODEC-338: PercentCodec loses literal '+' when plusForSpace is enabled. Thanks to Ruiqi Dong, Gary Gregory.
  • CODEC-337: Digest ALL reuses System.in, so only the first algorithm sees the real input (#431). Thanks to Ruiqi Dong, Gary Gregory.
  •         Fix Base64.toIntegerBytes(BigInteger) for zero edge case ([#441](https://github.com/apache/commons-codec/issues/441)). Thanks to Gary Gregory.

  •         Add messages when throwing NullPointerException. Thanks to Gary Gregory.

  •         Add messages when throwing NullPointerException. Thanks to Gary Gregory.

  •         StringEncoderComparator.StringEncoderComparator(StringEncoder) now fails fast on null input. Thanks to Gary Gregory.

Changes

  •         Bump org.apache.commons:commons-parent from 98 to 103. Thanks to Gary Gregory.

  •         Bump commons-io:commons-io from 2.21.0 to 2.22.0. Thanks to Gary Gregory.

For complete information on Apache Commons Codec, including instructions on how to submit bug reports, patches, or suggestions for improvement, see the Apache Commons Codec website:

https://commons.apache.org/proper/commons-codec/

Download page: https://commons.apache.org/proper/commons-codec/download_codec.cgi

Apache Commons Codec 1.22.0 Release Notes

The Apache Commons Codec team is pleased to announce the release of Apache Commons Codec 1.22.0.

... (truncated)

Commits
  • dc8f6c8 Prepare for the release candidate 1.22.1 RC1
  • 8203c1c Prepare for the next release candidate
  • 5647fe2 StringEncoderComparator.StringEncoderComparator(StringEncoder) now fails
  • 00c27a9 Reduce vertical whitespace
  • 568f2d7 Remove unused method
  • 316fb15 Remove unused method
  • bf6b543 Bump actions/checkout from 7.0.0 to 7.0.1
  • e14cdfe Extract redundant code.
  • 3351e63 Add messages when throwing NullPointerException.
  • f22dab7 Update SCM tag
  • Additional commits viewable in compare view

Updates tools.jackson.core:jackson-databind from 3.1.5 to 3.2.2

Commits
  • 3fd4e6f [maven-release-plugin] prepare release jackson-databind-3.2.2
  • 92eb111 Prep for 3.2.2 release
  • 18f42f5 Merge branch '3.1' into 3.2
  • 831a9a6 Post-release dep version bump
  • 9b927c0 [maven-release-plugin] prepare for next development iteration
  • 1f824e3 [maven-release-plugin] prepare release jackson-databind-3.1.6
  • 1f9cb5d Prep for 3.1.6 release
  • c88982d Merge branch '3.1' into 3.2
  • bcef554 Merge branch '2.x' into 3.1
  • 2e7c04e Merge branch '2.22' into 2.x
  • Additional commits viewable in compare view

Updates gradle-wrapper from 9.6.0 to 9.7.1

Release notes

Sourced from gradle-wrapper's releases.

9.7.1

The Gradle team is excited to announce Gradle 9.7.1.

This is a patch release for 9.7.0. We recommend using 9.7.1 instead of 9.7.0.

Here are the highlights of 9.7.0 release:

  • Isolated Projects graduates to incubating
  • Broader Configuration Cache compatibility
  • Resilient Sync helps you fix broken builds
  • More source locations in problem reports

Read the Release Notes

We would like to thank the following community members for their contributions to this release of Gradle: Adam, Aman Gautam, Aman Kumar, Anton Dubrouski, Aurimas, gbhavya07, Josh Friend, nicklauslittle-gov, Pragati, project516, Qin Mi, Ravi, sk-reddy17, Suvrat Acharya, Yongshun Ye.

Upgrade instructions

Switch your build to use Gradle 9.7.1 by updating your wrapper:

./gradlew :wrapper --gradle-version=9.7.1 && ./gradlew :wrapper

See the Gradle 9.x upgrade guide to learn about deprecations, breaking changes and other considerations when upgrading.

For Java, Groovy, Kotlin and Android compatibility, see the full compatibility notes.

Reporting problems

If you find a problem with this release, please file a bug on GitHub Issues adhering to our issue guidelines. If you're not sure you're encountering a bug, please use the forum.

We hope you will build happiness with Gradle, and we look forward to your feedback via Twitter or on GitHub.

9.7.0

The Gradle team is excited to announce Gradle 9.7.0.

... (truncated)

Commits

Updates org.json:json from 20260522 to 20260814

Release notes

Sourced from org.json:json's releases.

20260814

Pull Request Description
#1070 Fix XML.unescape for valid whitespace chars

20260719

Pull Request Description
#1069 pre-release-20260719 prep for next release
#1068 Max number length config for BigInteger and BigDecimal
#1067 bound BigDecimal→BigInteger expansion in objectToBigInteger (completes CVE-2026-59171 fix)
#1065 Fixes CVE-2026-59171
#1062 Refactor CDL row serialization for readability
#1061 Restore lenient jsonarray allow consecutive commas and insert null
#1058 Docs and warnings cleanup
Changelog

Sourced from org.json:json's changelog.

20260814 Fixes XML.unescape whitespace handling

20260719 Fixes CVE-2026-59171 very large BigInteger, BigDecimal

Commits
  • 6c14048 Merge pull request #1073 from stleary/pre-release-20260814
  • 34efda6 pre-release-20260814 initial commit
  • 22ab2fb Update jar file link in README
  • 392a352 Fix formatting of the latest release jar file link
  • b594a32 Merge pull request #1070 from dong0713/fix/xml-unescape-whitespace-control-chars
  • 94854a1 Fix XML.unescape rejecting valid whitespace numeric character references
  • 1795e8c Merge pull request #1069 from stleary/pre-release-20260719
  • da757c6 pre-release-20260719 oops forgot to update new unit tests for strict mode
  • d24bc9e pre-release-20260719 initial commit
  • 80efb52 Merge pull request #1068 from stleary/max-number-length-config
  • Additional commits viewable in compare view

Updates org.junit.jupiter:junit-jupiter-params from 6.1.0 to 6.1.3

Release notes

Sourced from org.junit.jupiter:junit-jupiter-params's releases.

JUnit 6.1.3 = Platform 6.1.3 + Jupiter 6.1.3 + Vintage 6.1.3

See Release Notes.

Full Changelog: junit-team/junit-framework@r6.1.2...r6.1.3

JUnit 6.1.2 = Platform 6.1.2 + Jupiter 6.1.2 + Vintage 6.1.2

See Release Notes.

Full Changelog: junit-team/junit-framework@r6.1.1...r6.1.2

JUnit 6.1.1 = Platform 6.1.1 + Jupiter 6.1.1 + Vintage 6.1.1

See Release Notes.

Full Changelog: junit-team/junit-framework@r6.1.0...r6.1.1

Commits
  • f59f60d Release 6.1.3
  • cd8ec92 Finalize 6.1.3 release notes
  • c8729f2 Restore compatibility with GraalVM 25 (#5901)
  • ddc9e74 Update graalvm/setup-graalvm action to v1.6.4 (#5959)
  • fe2c52a Update plugin org.graalvm.buildtools.native to v1.1.7 (#5923)
  • 62afc02 Delay GraalVM plugin updates for 3 days
  • 0cc2902 Skip graalVmTest task if GraalVM env vars are not set
  • f6bbfc5 Move GraalVM tests to separate test task (#5903)
  • e87e052 Update plugin org.graalvm.buildtools.native to v1.1.6 (#5899)
  • 1cd56df Update plugin org.graalvm.buildtools.native to v1.1.5 (#5880)
  • Additional commits viewable in compare view

Updates org.jetbrains.kotlin:kotlin-reflect from 2.4.0 to 2.4.10
Updates org.jetbrains.kotlin:kotlin-stdlib-jdk8 from 2.4.0 to 2.4.10
Updates org.jetbrains.kotlin.plugin.allopen from 2.4.0 to 2.4.10
Updates org.jetbrains.kotlin.jvm from 2.4.0 to 2.4.10
Updates org.jetbrains.kotlin:kotlin-stdlib-jdk8 from 2.4.0 to 2.4.10
Updates ch.qos.logback:logback-classic from 1.5.34 to 1.6.3

Release notes

Sourced from ch.qos.logback:logback-classic's releases.

Logback 1.6.3

2026-08-14 Release of logback version 1.6.3

  • In response CVE-2026-19880, MDCBasedDiscriminator (used by SiftingAppender) now strips forward and backward slashes (/, \) from MDC values before they are used as discriminating keys. This prevents path segments from escaping into destinations controlled by an attacker. When sanitisation actually changes a value, a warning is emitted; the warning is rate-limited (a small batch, then a lull of about ten minutes).

  • Colour console support is split out into a dedicated JansiConsoleAppender. It wraps stdout or stderr with Jansi so ANSI escape sequences (for example coloured patterns) render correctly on terminals that need it, notably Windows. Prefer this class over the older path described next. See the appenders documentation.

  • The withJansi property on ConsoleAppender is deprecated. Existing configurations that still set <withJansi>true</withJansi> continue to work for compatibility, but new setups should use JansiConsoleAppender instead.

  • ConsoleAppender no longer treats the process console as an exclusive resource: stopping it does not close System.out / System.err. JansiConsoleAppender pairs each AnsiConsole.systemInstall() with systemUninstall() on stop, so repeated start/stop cycles do not leave Jansi installed or tear down streams shared with the rest of the JVM. Related behavior is covered by tests for issues/1063.

  • Invocation throttling helpers were reworked: SimpleInvocationGate is renamed FixedIntervalInvocationGate, and BatchedFixedIntervalInvocationGate allows a short burst of invocations before applying a fixed lull. The sanitisation warning above uses the batched gate.

  • The JPMS module-info for logback-core now exports the ch.qos.logback.core.property package, which had been missing from the module descriptor.

  • A bit-wise identical binary of this version can be reproduced by building from source code at commit e8e824dede022a6d7208b36cfa875b0d1b7772f3 associated with the tag v_1.6.3. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

-- Sponsoring SLF4J/logback/reload4j at https://github.com/sponsors/qos-ch

Logback 1.6.2

clean.full.1.6.2.mp4

2026-08-10 Release of logback version 1.6.2

  • Configuration analysis now detects contradictory caller-data inclusion instructions. For example, an AsyncAppender, SocketAppender or SMTPAppender with includeCallerData left at the default false is incompatible with a layout or encoder pattern that uses a caller-data converter such as %C, %M, %L, %F, %l or %caller. At runtime those converters would print question marks and still incur extraction cost on a worker thread. Logback now emits a configuration-time warning when such instructions disagree. See codes.html#callerContradiction for details. This issue was reported in issues/1059 by leeychee. The initial analysis was contributed by seonwoo_jung.

  • Caller-contradiction analysis can be turned off by setting the logback.skipCallerContradictionAnalysis variable to true, either as a system property (-Dlogback.skipCallerContradictionAnalysis=true) or as a property in the configuration file:

    <property name="logback.skipCallerContradictionAnalysis" value="true"/>

  • SimpleSocketServer and SimpleSSLSocketServer now require an explicit client IP whitelist. On the command line, pass one or more allowed addresses (single IPs or CIDR ranges) after the configuration file. An empty whitelist means no clients are accepted. When embedding the server programmatically, register allowed addresses with addAllowedClientAddress(String) or setAllowedClientAddresses(Collection) before clients connect. See the documentation on restricting client access.

  • Added ThrowableProxyVOBuilder for assembling a ThrowableProxyVO field by field, with a corresponding ThrowableProxyVO.builder() entry point.

  • Dependency analysis handlers now run their postHandle method after child models have been processed, so checks that depend on nested appenders (such as caller-contradiction analysis) see a complete picture.

  • Updated several dependencies, including Angus Mail to 2.0.4 and Jetty (test) to 12.1.12.

  • A bit-wise identical binary of this version can be reproduced by building from source code at commit e3d78330ad1ba024fd987fd00c3ffb9cfcdb07dc associated with the tag v_1.6.2. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.6.1

2026-07-28 Release of logback version 1.6.1

• In TimeBasedRollingPolicy, when the file option is set, the intermediate file renamed before asynchronous compression now receives the target archive name without the compression suffix (e.g. .gz, .zip, .xz). Previously it used a nanotime-based .tmp suffix. This makes the file easier to identify if compression fails during rollover. (See also the following paragraph.)

... (truncated)

Commits
  • e8e824d prepare release 1.6.3
  • 761821b MDCBasedDiscriminator has a gated warning mechanism
  • 53ed122 update copyright year
  • c7e2db2 rename SimpleInvocationGate as FixedIntervalInvocationGate
  • b5aa931 added BatchedSimpleInvocationGate
  • 1f22af7 add javadocs to SimpleInvocationGate
  • 638ffa7 prevent forward and backward slashes to escape to other directories
  • 7d6b9a4 add missing ch.qos.logback.core.property package
  • fa25930 add an extension path in ConsoleAppender for JansiConsoleAppender
  • c73b43f deprecate the withJansi path
  • Additional commits viewable in compare view

Updates io.micronaut.platform:micronaut-platform from 5.0.2 to 5.1.3

Release notes

Sourced from io.micronaut.platform:micronaut-platform's releases.

Micronaut Platform 5.1.3

Full Changelog: micronaut-projects/micronaut-platform@v5.1.2...v5.1.3

Micronaut Platform 5.1.2

Full Changelog: micronaut-projects/micronaut-platform@v5.1.1...v5.1.2

Micronaut Platform 5.1.1

What's Changed

Other Changes 💡

Full Changelog: micronaut-projects/micronaut-platform@v5.1.0...v5.1.1

Micronaut Platform 5.1.0

Micronaut Core (5.0.7 → 5.1.10)

Adds explicit @Introspected.Property, sequenced-collection injection, CDI integration hooks, KSP traversal of Kotlin inner classes, configuration-based logger levels, and per-service client SSL enabled by default. It also fixes request-bean binding, Jackson/introspection properties, AOP proxies, factory beans, and suspend-function type aliases.

AI

Micronaut LangChain4j (2.0.1 → 2.2.0)

... (truncated)

Commits
  • 167ba52 [skip ci] Release v5.1.3
  • bdc9674 Merge branch '5.1.x' into 5.2.x
  • 88cf543 Add Micronaut release links skill
  • fc3ddde Ignore unfixed legacy MySQL connector vulnerability
  • 6760db8 Update dependency io.micronaut.aws:micronaut-aws-bom to v5.1.1 (#2777)
  • b24c1d5 Update actions/setup-java action to v6 (#2778)
  • 8eb31fb Update dependency io.micronaut.data:micronaut-data-bom to v5.1.3 (#2780)
  • 5a70ada Update dependency io.micronaut.reactor:micronaut-reactor-bom to v4.2.0 (#2781)
  • 424bb65 Update mikepenz/action-junit-report digest to a9170d5 (#2782)
  • cf67250 Update dependency io.micronaut.micrometer:micronaut-micrometer-bom to v6.0.2 ...
  • Additional commits viewable in compare view

Updates io.viascom.nanoid:nanoid from 1.0.1 to 2.0.1

Release notes

Sourced from io.viascom.nanoid:nanoid's releases.

2.0.1

What's Changed

Full Changelog: viascom/nanoid-kotlin@2.0.0...2.0.1

2.0.0

Breaking changes

The API is unchanged for all default-parameter call forms, from Kotlin and Java alike (the Java static API is guarded by a dedicated test). One breaking change: the random parameter is now kotlin.random.Random instead of java.util.Random, and the java.util.Random overloads are gone. If you passed a custom random, wrap it:

// Kotlin
NanoId.generate(random = SecureRandom().asKotlinRandom())
// Java
NanoId.generate(21, alphabet, 1.6, PlatformRandomKt.asKotlinRandom(new SecureRandom()));

The default RNG changed from SecureRandom() to CryptographyRandom.Default, a CSPRNG on every platform. Note that seeded java.util.Random streams from 1.x produce different ids than seeded kotlin.random.Random streams; re-pin any golden values if you relied on them. See Migrating from 1.x in the README.

Supported targets

JVM (toolchain 17), JS (browser + Node.js), Wasm/JS (browser + Node.js), iOS (arm64, x64, simulator arm64), macOS (arm64), tvOS (arm64, simulator arm64), watchOS (arm32, arm64, device arm64, simulator arm64), Linux (x64, arm64) and Windows (mingwX64).

What's Changed

Credits

Special thanks to @​HLCaptain for kicking off the multiplatform effort: proposing it in viascom/nanoid-kotlin#11, prototyping it in their fork (viascom/nanoid-kotlin#14), and pointing us to cryptography-kotlin, whose cryptography-random module now provides the platform CSPRNGs in this release. 🙏

Full Changelog: viascom/nanoid-kotlin@1.0.1...2.0.0

Commits
  • e42aec2 chore: bump version to 2.0.1
  • 321d8f2 build(deps): update Gradle wrapper to 9.7.0 and bump CI actions
  • a6f675f build(deps): raise npm security floors for JS build toolchain (#39)
  • 132f8da ci: fix base64 decoding option in publish workflow
  • f26b6cb Merge pull request #38 from viascom/feature/multiplatform-v1
  • f2ea389 ci: disable credential persistence on checkout
  • bc1622b ci: bump actions to Node 24 majors and gradle wrapper-validation v6
  • 3b5016f ci: match slash-named branches in build push trigger
  • 3483c08 ci: update Maven Central credentials and tidy up platform targets
  • 75e2c27 docs: update README for 2.0.0 multiplatform
  • Additional commits viewable in compare view

Updates io.projectreactor:reactor-core from 3.8.6 to 3.8.7

Release notes

Sourced from io.projectreactor:reactor-core's releases.

v3.8.7

Reactor Core 3.8.7 is part of the 2025.0.7 and 2026.0.0-M1 Release Trains.

What's Changed

🐞 Bug fixes

  • Fix elapsed time computation in OptimisticEmitFailureHandler by @​bjmi in #4112
  • Fix windowTimeout fair-backpressure index wraparound by @​chemicL in 9fdb2cf7108d738fe80e65d010571982610b7eb8
  • Guard against flush-state update in FluxBufferTimeout by @​Sage-Pierce in 1791421affc59e0a551ba8596e4122c069e782ba

New Contributors

Full Changelog: reactor/reactor-core@v3.8.6...v3.8.7

Commits
  • cda5359 [release] Prepare and release 3.8.7
  • c2b3afd Prepare release/3.8.7 branch
  • 1791421 Guard against flush-state update in FluxBufferTimeout
  • 9fdb2cf Fix windowTimeout fair-backpressure index wraparound
  • 200db94 Prepare main-internal branch
  • a794eae Bump github/codeql-action from 4.37.5 to 4.37.6 in /.github/workflows (#4353)
  • 87cdb28 Bump github/codeql-action from 4.37.4 to 4.37.5 in /.github/workflows (#4351)
  • ed121c4 Bump gradle/actions/wrapper-validation from 6.2.0 to 6.3.0 in /.github/workfl...
  • 869b950 Bump gradle/actions/setup-gradle from 6.2.0 to 6.3.0 in /.github/workflows (#...
  • 4f160fa Bump @​antora/pdf-extension from 1.0.0-rc.6 to 1.0.0-rc.7 in /docs (#4348)
  • Additional commits viewable in compare view

Updates org.yaml:snakeyaml from 2.6 to 2.7

Updates org.jetbrains.kotlin.plugin.allopen from 2.4.0 to 2.4.10
Updates org.jetbrains.kotlin.jvm from 2.4.0 to 2.4.10
Updates com.google.devtools.ksp from 2.3.9 to 2.3.11

Release notes

Sourced from com.google.devtools.ksp's releases.

2.3.11

What's Changed

  • Support org.gradle.isolated-projects for project isolation (#3051)
  • Fix premature kspDebugAndroidTest task skipping on Android library modules (#3050)
  • Fix missing parent declaration exception for @NotNull annotations during incremental compilation (#3030)
  • Clean output directories instead of skipping tasks when processor classpath transitions to empty (#3046)
  • Fix build cache misses by marking KspGradleConfig.logLevel as @Internal (#3039)
  • Add org.gradle.isolated-projects=true to KSP Gradle properties reference table (#3076)
  • Add KSP Gradle properties reference table to README documentation (#3070)
  • Document collection values in KSValueArgument.value (#3069)
  • Update error messaging for ksp.useKSP2 deprecation notice (#3066)

Contributors

Full Changelog: google/ksp@2.3.10...2.3.11

2.3.10

What's Changed

  • Fix OOMs caused by unstopped coroutine Dispatcher threads by moving KSP task cache to a gradle build service (#2817)
  • Sanitize ':' in internal-name module suffix so KSP works with Kotlin 2.4.0 default module names (#2964)
  • Filter source file trees in KspAATask to restore NO-SOURCE skipping behaviour (#2947)
  • Fix R-class resolution in KSP when AGP 9 built-in Kotlin is enabled (#2857)
  • Fix KSP2 incremental cache path normalization mismatch (#2854)
  • Normalize line endings for KspAATask source roots to prevent cross-platform remote build cache misses (#2849)
  • Fix bug where KSP incremental compilation does not consider library class references in annotations (#3011)
  • Consume all Kotlin sources in KSP to support other code generators (#3001)
  • Fix configuration cache invalidation in klib cross-compilation check (#3014)
  • Memoized hash code for KSTypeImpl to speed up processing (#2896)
  • Fix incorrect name generation for data classes annotated with @JvmRecord (#2813)
  • Include kotlinx.coroutines in the distributed uber jar symbol-processing-aa-embeddable (#2938)
  • New debugging features for incremental compilation, including additional logging and dependency graph visualization (#3015)
  • Deprecate the ksp(...) Gradle configuration in Kotlin Multiplatform (KMP) projects in favor of target-specific configurations (#2956). Note: Non-KMP projects are also affected. For migration details, see the documentation.

Contributors

Full Changelog: google/ksp@2.3.9...2.3.10

Commits
  • c44fd9a Rename coroutines core-jvm alias to coreJvm per review
  • 5cec34d Move root build plugin versions to the version catalog
  • b956e6b Move remaining kotlin-analysis-api versions to the version catalog
  • 9aed497 Do not cherry-pick conflicting commits in CI auto-merge workflow
  • 145dcd6 Update gradle wrapper to 9.5.0
  • 68762a9 Check for valid gradle wrapper jar in CI
  • 336a2e4 Regenerate gradle wrapper
  • 94d5e09 Use gh cli for release asset upload
  • d244982 Disable all permissions in main workflow
  • b88bc0d Pin actions/upload-release-asset at v1.0.2 SHA
  • Additional commits viewable in compare view

Updates io.micronaut.aot from 5.0.0 to 5.0.2

Updates io.micronaut.application from 5.0.0 to 5.0.2

Updates io.micronaut.test-resources from 5.0.0 to 5.0.2

Updates io.micronaut.application from 5.0.0 to 5.0.2

Updates io.micronaut.test-resources from 5.0.0 to 5.0.2

Updates com.gradleup.shadow from 9.4.2 to 9.6.1

Release notes

Sourced from com.gradleup.shadow's releases.

9.6.1

Changed

  • Use GradleException for expected build failures. (#2113)

Fixed

  • Preserve repeated lines in R8 rule files when using minimize { r8 { ... } }. (#2115)

9.6.0

Added

<...

Description has been truncated

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Sep 8, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner September 8, 2026 12:33
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Sep 8, 2026
@dependabot
Bump the project-dependencies group across 1 directory with 21 updates
8f8d2bb 
---
updated-dependencies:
- dependency-name: ch.qos.logback:logback-classic
  dependency-version: 1.6.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: project-dependencies
- dependency-name: com.google.devtools.ksp
  dependency-version: 2.3.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: project-dependencies
- dependency-name: com.gradleup.shadow
  dependency-version: 9.6.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: project-dependencies
- dependency-name: commons-codec:commons-codec
  dependency-version: 1.22.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: project-dependencies
- dependency-name: gradle-wrapper
  dependency-version: 9.7.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: project-dependencies
- dependency-name: io.micronaut.aot
  dependency-version: 5.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: project-dependencies
- dependency-name: io.micronaut.application
  dependency-version: 5.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: project-dependencies
- dependency-name: io.micronaut.application
  dependency-version: 5.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: project-dependencies
- dependency-name: io.micronaut.platform:micronaut-platform
  dependency-version: 5.1.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: project-dependencies
- dependency-name: io.micronaut.test-resources
  dependency-version: 5.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: project-dependencies
- dependency-name: io.micronaut.test-resources
  dependency-version: 5.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: project-dependencies
- dependency-name: io.projectreactor:reactor-core
  dependency-version: 3.8.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: project-dependencies
- dependency-name: io.viascom.nanoid:nanoid
  dependency-version: 2.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: project-dependencies
- dependency-name: org.apache.commons:commons-lang3
  dependency-version: 3.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: project-dependencies
- dependency-name: org.codehaus.plexus:plexus-utils
  dependency-version: 4.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: project-dependencies
- dependency-name: org.jetbrains.kotlin.jvm
  dependency-version: 2.4.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: project-dependencies
- dependency-name: org.jetbrains.kotlin.jvm
  dependency-version: 2.4.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: project-dependencies
- dependency-name: org.jetbrains.kotlin.plugin.allopen
  dependency-version: 2.4.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: project-dependencies
- dependency-name: org.jetbrains.kotlin.plugin.allopen
  dependency-version: 2.4.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: project-dependencies
- dependency-name: org.jetbrains.kotlin:kotlin-reflect
  dependency-version: 2.4.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: project-dependencies
- dependency-name: org.jetbrains.kotlin:kotlin-stdlib-jdk8
  dependency-version: 2.4.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: project-dependencies
- dependency-name: org.jetbrains.kotlin:kotlin-stdlib-jdk8
  dependency-version: 2.4.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: project-dependencies
- dependency-name: org.json:json
  dependency-version: '20260814'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: project-dependencies
- dependency-name: org.junit.jupiter:junit-jupiter-params
  dependency-version: 6.1.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: project-dependencies
- dependency-name: org.yaml:snakeyaml
  dependency-version: '2.7'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: project-dependencies
- dependency-name: tools.jackson.core:jackson-databind
  dependency-version: 3.2.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: project-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/gradle/project-dependencies-d0c2661a17 branch from 3a08c96 to 8f8d2bb Compare September 9, 2026 09:45
@mmwinther
mmwinther merged commit 8fbc4a2 into main Sep 15, 2026
6 checks passed
@mmwinther
mmwinther deleted the dependabot/gradle/project-dependencies-d0c2661a17 branch September 15, 2026 10:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mmwinther mmwinther mmwinther approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update Java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@mmwinther