Skip to content

chore(deps): Bump the gradle group across 1 directory with 10 updates - #137

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/gradle/sdk/android/gradle-79240e4617
Open

chore(deps): Bump the gradle group across 1 directory with 10 updates#137
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/gradle/sdk/android/gradle-79240e4617

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 1, 2026

Copy link
Copy Markdown
Contributor

Bumps the gradle group with 10 updates in the /sdk/android directory:

Package From To
androidx.core:core-ktx 1.19.0 1.19.1
androidx.appcompat:appcompat 1.7.0 1.8.0
com.squareup.okhttp3:okhttp 5.4.0 5.5.1
org.jetbrains.kotlinx:kotlinx-serialization-json 1.11.0 1.12.0
com.nimbusds:nimbus-jose-jwt 10.9.1 10.10
org.jetbrains.kotlinx:kotlinx-coroutines-test 1.11.0 1.12.0
com.squareup.okhttp3:mockwebserver 5.4.0 5.5.1
com.android.library 9.3.1 9.5.0
org.jetbrains.kotlin.android 2.4.10 2.4.21
org.jetbrains.kotlin.plugin.serialization 2.4.10 2.4.21

Updates androidx.core:core-ktx from 1.19.0 to 1.19.1

Updates androidx.appcompat:appcompat from 1.7.0 to 1.8.0

Updates com.squareup.okhttp3:okhttp from 5.4.0 to 5.5.1

Changelog

Sourced from com.squareup.okhttp3:okhttp's changelog.

Version 5.5.1

2026_10_22

  • Fix: [Block 8 compromised eMudhra intermediate certificates][Mozilla_eMudhra]. Note that this update is not necessary for Android devices with Google Play Services as Google has issued an [automatic update][Google_eMudhra]. This change protects JVMs and AOSP devices that are exposed to the compromised certificates.

Version 5.5.0

2026-08-16

This release introduces opt-in support for [Encrypted Client Hello (ECH)]. This new feature improves user privacy by encrypting domain names in transit. With regular TLS, your coffee shop’s Wi-Fi router can see that you’re visiting wikipedia.com, but it cannot see which page you’re looking at. With ECH, the router observes only the IP address. This additional privacy is most effective on sites hosted by big CDNs because the IP address doesn’t imply a particular website.

This requires ECH support in the platform’s TLS stack. Today this is only Android 17 (API 37, released June 2026). When other TLS stacks add ECH support, we'll integrate them.

ECH took a lot of work to implement because the encryption keys are published over DNS in the [HTTPS resource record], and we needed to write new code to fetch these records. This release includes a major update to OkHttp’s DNS API: it now supports multiple resource record types (not just IP addresses!), asynchronous streaming results, and in-memory caching.

To opt in, you can use DnsOverHttps:

// DnsOverHttps itself uses OkHttpClient. Build both clients upon the
// same bootstrap client so they share a connection pool and dispatcher.
val bootstrapClient = OkHttpClient()
// This sample uses Cloudflare's 1.1.1.1 DnsOverHttps service.
val client = bootstrapClient.newBuilder()
.dns(DnsOverHttps.Builder()
.client(bootstrapClient)
.url("https://1.1.1.1/dns-query".toHttpUrl())
.build())
.build()

You could also opt in with our new AndroidDns API. Unfortunately, the privacy benefits of ECH are thwarted because its DNS queries are not encrypted by default.

// AndroidDns fetches the HTTPS DNS resource records necessary for ECH.
val client = OkHttpClient.Builder()
</tr></table>

... (truncated)

Commits

Updates org.jetbrains.kotlinx:kotlinx-serialization-json from 1.11.0 to 1.12.0

Release notes

Sourced from org.jetbrains.kotlinx:kotlinx-serialization-json's releases.

v1.12.0

This release is based on Kotlin 2.4.10 and contains all of the changes from 1.12.0-RC.

Additionally, it includes a fix removing unnecessary leading whitespaces from Proguard rules (#3270), and two changes stabilizing kotlin.uuid.Uuid serializer (#3263) and kotlin.time.Instant serializers (#3261).

For your convenience, the changelog for 1.12.0-RC is duplicated below:

API stabilization and deprecations

A big portion of the Json and Core APIs has been stabilized. Most important ones include: @KeepGeneratedSerializer and @SerialInfo annotations, JsonNamingStrategy, and ContextualSerializer. Additionally, various descriptor builders such as listDescriptor and JsonElementBuilder's addAll functions are also stable and can be freely used. There is also one deprecation: ChunkedDecoder interface. Since there is no demand for it, we plan to remove it in the future. See details in the #3238, #3239, and #3216.

Also, kotlin.time.Instant and kotlin.uuid.Uuid serializers are no longer annotated with experimental annotations from the Kotlin standard library (see #3261 and #3263)

Performance improvements

We also improved performance in various areas. ASCII-specific parser (#3225) brings performance of decoding from Okio and kotlinx-io sources closer to decoding performance from String. #3220 makes decoding significantly faster in case JsonElement present in your serializable classes. And #3248 should bring overall performance improvements (up to 30%) on large strings.

Exceptions rework

We continue to improve exception handling in Json encoders and decoders. #3235 makes a big change around custom serializers and @Serializable classes constructors: from now on, every exception thrown during deserialization is wrapped by decoder into a JsonException. This way, it is more predictable to write a catch and it is easier to understand what went wrong: JsonDecodingException also includes context information such as Json path and input. Besides that, #3246 limits maximum nesting depth of Json document, so you will get a proper JsonDecodingException instead of a random stack overflow error.

CBOR improvements

CBOR format also gets many improvements in this release. The most important one is memory optimization for definitely-sized collections (#3191, #3192).

The others include:

  • Encode unsigned integer types as positive integers (#3194) (thanks to Eyüp Can Akman)
  • Correctly decode CborLabel values (#3195)
  • Include actual tag info into CborDecodingException (#3197)

Protobuf improvements

Protocol buffers format received a big new feature: support for unknown fields. Using a new ProtoUnknownFieldHolder class, you can now decode and store unknown fields in Protobuf messages to retransmit them back later. See documentation updates and #2860 for details.

... (truncated)

Changelog

Sourced from org.jetbrains.kotlinx:kotlinx-serialization-json's changelog.

1.12.0 / 2026-10-19

This release is based on Kotlin 2.4.10 and contains all of the changes from 1.12.0-RC.

Additionally, it includes a fix removing unnecessary leading whitespaces from Proguard rules (#3270), and two changes stabilizing kotlin.uuid.Uuid serializer (#3263) and kotlin.time.Instant serializers (#3261).

For your convenience, the changelog for 1.12.0-RC is duplicated below:

API stabilization and deprecations

A big portion of the Json and Core APIs has been stabilized. Most important ones include: @KeepGeneratedSerializer and @SerialInfo annotations, JsonNamingStrategy, and ContextualSerializer. Additionally, various descriptor builders such as listDescriptor and JsonElementBuilder's addAll functions are also stable and can be freely used. There is also one deprecation: ChunkedDecoder interface. Since there is no demand for it, we plan to remove it in the future. See details in the #3238, #3239, and #3216.

Also, kotlin.time.Instant and kotlin.uuid.Uuid serializers are no longer annotated with experimental annotations from the Kotlin standard library (see [#3261](Kotlin/kotlinx.serialization#3261 and #3263)

Performance improvements

We also improved performance in various areas. ASCII-specific parser (#3225) brings performance of decoding from Okio and kotlinx-io sources closer to decoding performance from String. #3220 makes decoding significantly faster in case JsonElement present in your serializable classes. And #3248 should bring overall performance improvements (up to 30%) on large strings.

Exceptions rework

We continue to improve exception handling in Json encoders and decoders. #3235 makes a big change around custom serializers and @Serializable classes constructors: from now on, every exception thrown during deserialization is wrapped by decoder into a JsonException. This way, it is more predictable to write a catch and it is easier to understand what went wrong: JsonDecodingException also includes context information such as Json path and input. Besides that, #3246 limits maximum nesting depth of Json document, so you will get a proper JsonDecodingException instead of a random stack overflow error.

CBOR improvements

CBOR format also gets many improvements in this release. The most important one is memory optimization for definitely-sized collections (#3191, #3192).

... (truncated)

Commits

Updates com.nimbusds:nimbus-jose-jwt from 10.9.1 to 10.10

Changelog

Sourced from com.nimbusds:nimbus-jose-jwt's changelog.

10.9.1 (2026-05-31) * Fixes health status reporting when RefreshAheadCachingJWKSetSource, JWKSetSourceWithHealthStatusReporting and OutageTolerantJWKSetSource are used together. A failed refresh-ahead background update could previously cause JWKSetSourceWithHealthStatusReporting to mark the JWK set source as UNHEALTHY, even though OutageTolerantJWKSetSource was still within its configured outage tolerance window and regular JWT validation could continue using the cached JWK set. Refresh-ahead failures that are covered by outage tolerance no longer cause the health status to become unhealthy before the outage tolerance period has been exceeded (iss #619).

10.10 (2026-09-17) * Adds JWEObject.MAX_DECOMPRESSED_PLAIN_TEXT_LENGTH for the default maximum allowed length of decompressed plain text, in bytes. Used to establish an active (dynamic) safety limit against zip-bomb attacks. Set to 1 mio bytes (iss #611). * Adds MaxDecompressedPlainTextLength implementing JWEDecrypterOption, to enable applications to override the default JWEObject.MAX_DECOMPRESSED_PLAIN_TEXT_LENGTH (iss #611). * Adds explicit non-null checks to DeflateUtils (iss #611). * Fixes potential native memory resource leak in DeflateUtils when Deflater or Inflater instances were not guaranteed to call .end() if stream closing or processing threw an exception (iss #611). * Optimizes DeflateUtils resource management and memory allocation by guaranteeing native stream cleanup, validating inputs, and pre-allocating decompression buffers (iss #611). * Updates to com.google.code.gson:gson:2.14.0 * Updates to com.google.crypto.tink:tink:1.23.0 * Updates to BouncyCastle 1.86

11.0 (2026-09-xx) * Compile source and target bumped from Java 7 to Java 8. * Optimises JWS input composition for unencoded payloads (RFC 7797) to conserve memory and CPU cycles. Introduces a helper JWSInput interface with a ByteArrayJWSInput and ComposedJWSInput implementations for the JWS input composition when the payloaded is encoded and when not (iss #613). * Adds JWTClaimsSet.getInstantClaims, getExpirationInstant, getNotBeforeInstant and getIssueInstant methods. Adds JWTClaimsSet.Builder.expirationInstant, notBeforeInstant and issueInstant methods. * Adds JSONObjectUtils.getEpochSecondAsInstant static method. * Overrides equals and hashCode in Payload. * Fixes health status reporting when RefreshAheadCachingJWKSetSource, JWKSetSourceWithHealthStatusReporting and OutageTolerantJWKSetSource are used together. A failed refresh-ahead background update could previously cause JWKSetSourceWithHealthStatusReporting to mark the JWK set source as UNHEALTHY, even though OutageTolerantJWKSetSource was still within its configured outage tolerance window and regular JWT validation could continue using the cached JWK set. Refresh-ahead failures that are

... (truncated)

Commits
  • e055b3b [maven-release-plugin] prepare for next development iteration
  • c06d769 Adds JWEObject.MAX_DECOMPRESSED_PLAIN_TEXT_LENGTH - 10.x WIP (iss #611)
  • a427513 Adds explicit non-null checks to DeflateUtils (iss #611)
  • 3302e15 Fixes potential native memory resource leak in DeflateUtils when Deflater or ...
  • d004e79 Optimizes DeflateUtils resource management and memory allocation by guarantee...
  • 98ed6ba Adjusts JWEObject.MAX_DECOMPRESSED_PLAIN_TEXT_LENGTH to 1 mio bytes (iss #611)
  • 0350144 Adds MaxDecompressedPlainTextLength implementing JWEDecrypterOption (iss #611)
  • 218575f Wires MaxDecompressedPlainTextLength (iss #611)
  • 3fcb8f5 Adds MaxDecompressedPlainTextLength tests for each JWEDecrypter (iss #611)
  • 14ae7ac Adds CHANGELOG.txt entries (iss #611)
  • Additional commits viewable in compare view

Updates org.jetbrains.kotlinx:kotlinx-coroutines-test from 1.11.0 to 1.12.0

Updates com.squareup.okhttp3:mockwebserver from 5.4.0 to 5.5.1

Changelog

Sourced from com.squareup.okhttp3:mockwebserver's changelog.

Version 5.5.1

2026_10_22

  • Fix: [Block 8 compromised eMudhra intermediate certificates][Mozilla_eMudhra]. Note that this update is not necessary for Android devices with Google Play Services as Google has issued an [automatic update][Google_eMudhra]. This change protects JVMs and AOSP devices that are exposed to the compromised certificates.

Version 5.5.0

2026-08-16

This release introduces opt-in support for [Encrypted Client Hello (ECH)]. This new feature improves user privacy by encrypting domain names in transit. With regular TLS, your coffee shop’s Wi-Fi router can see that you’re visiting wikipedia.com, but it cannot see which page you’re looking at. With ECH, the router observes only the IP address. This additional privacy is most effective on sites hosted by big CDNs because the IP address doesn’t imply a particular website.

This requires ECH support in the platform’s TLS stack. Today this is only Android 17 (API 37, released June 2026). When other TLS stacks add ECH support, we'll integrate them.

ECH took a lot of work to implement because the encryption keys are published over DNS in the [HTTPS resource record], and we needed to write new code to fetch these records. This release includes a major update to OkHttp’s DNS API: it now supports multiple resource record types (not just IP addresses!), asynchronous streaming results, and in-memory caching.

To opt in, you can use DnsOverHttps:

// DnsOverHttps itself uses OkHttpClient. Build both clients upon the
// same bootstrap client so they share a connection pool and dispatcher.
val bootstrapClient = OkHttpClient()
// This sample uses Cloudflare's 1.1.1.1 DnsOverHttps service.
val client = bootstrapClient.newBuilder()
.dns(DnsOverHttps.Builder()
.client(bootstrapClient)
.url("https://1.1.1.1/dns-query&quot;.toHttpUrl())
.build())
.build()

You could also opt in with our new AndroidDns API. Unfortunately, the privacy benefits of ECH are thwarted because its DNS queries are not encrypted by default.

// AndroidDns fetches the HTTPS DNS resource records necessary for ECH.
val client = OkHttpClient.Builder()
</tr></table>

... (truncated)

Commits

Updates com.android.library from 9.3.1 to 9.5.0

Updates org.jetbrains.kotlin.android from 2.4.10 to 2.4.21

Release notes

Sourced from org.jetbrains.kotlin.android's releases.

Kotlin 2.4.21

Changelog

Backend. Wasm

  • KT-89267 K/Wasm: calling a (T) -> R lambda with an argument that isn't a T traps instead of throwing ClassCastException

JVM. Reflection

  • KT-89280 NoSuchElementException in argumentsMakeSenseOnlyForMutableContainer for Java non-static inner class of generic outer class
  • KT-80710 Reflection: change KCallable representation to avoid dependency on K1

JavaScript

  • KT-89449 Kotlin/JS: Member names no longer minified in production
  • KT-89363 KJS. Regular class with companion can't extend external class

Tools. Compiler plugins. Serialization

  • KT-89275 Kotlin/Wasm: Invalid Wasm is emitted for a @Serializable generic class with a class upper bound

Tools. Gradle. Native

  • KT-89285 SwiftPM import results in flooded log
  • KT-86251 K/N: Flaky linkDebugTestLinuxX64 failure with "truncated or malformed archive" on libstdlib-cache.a

Tools. Scripts

  • KT-89247 Kotlin Script: NoClassDefFoundError on 2nd execution with transitive dependency from imported script
  • KT-89220 JSR-223: generic Java bindings break all subsequent eval() calls
  • KT-88458 Audit closeable resource usage
  • KT-88453 VirtualFileScriptSource.text leaks an unclosed file stream — script source file handle held until GC, blocks file deletion on Windows

Kotlin 2.4.21-RC

Changelog

Backend. Wasm

  • KT-89267 K/Wasm: calling a (T) -> R lambda with an argument that isn't a T traps instead of throwing ClassCastException

JVM. Reflection

  • KT-89280 NoSuchElementException in argumentsMakeSenseOnlyForMutableContainer for Java non-static inner class of generic outer class
  • KT-80710 Reflection: change KCallable representation to avoid dependency on K1

JavaScript

  • KT-89449 Kotlin/JS: Member names no longer minified in production
  • KT-89363 KJS. Regular class with companion can't extend external class

... (truncated)

Changelog

Sourced from org.jetbrains.kotlin.android's changelog.

2.4.21

Backend. Wasm

  • KT-89267 K/Wasm: calling a (T) -> R lambda with an argument that isn't a T traps instead of throwing ClassCastException

JVM. Reflection

  • KT-89280 NoSuchElementException in argumentsMakeSenseOnlyForMutableContainer for Java non-static inner class of generic outer class
  • KT-80710 Reflection: change KCallable representation to avoid dependency on K1

JavaScript

  • KT-89449 Kotlin/JS: Member names no longer minified in production
  • KT-89363 KJS. Regular class with companion can't extend external class

Tools. Compiler plugins. Serialization

  • KT-89275 Kotlin/Wasm: Invalid Wasm is emitted for a @Serializable generic class with a class upper bound

Tools. Gradle. Native

  • KT-89285 SwiftPM import results in flooded log
  • KT-86251 K/N: Flaky linkDebugTestLinuxX64 failure with "truncated or malformed archive" on libstdlib-cache.a

Tools. Scripts

  • KT-89247 Kotlin Script: NoClassDefFoundError on 2nd execution with transitive dependency from imported script
  • KT-89220 JSR-223: generic Java bindings break all subsequent eval() calls
  • KT-88458 Audit closeable resource usage
  • KT-88453 VirtualFileScriptSource.text leaks an unclosed file stream — script source file handle held until GC, blocks file deletion on Windows

2.4.20

Analysis API

  • KT-86546 Check suspicious when over ConeKotlinType in ConeTypeCompatibilityChecker
  • KT-85418 Implement an API for accessing deserialized file annotations in Analysis API
  • KT-74448 K2. False positive MISSING_DEPENDENCY_SUPERCLASS in LinkedListTest.kt, kotlinx.coroutines
  • KT-85856 containingSymbol of constructor property differs for local and non-local classes
  • KT-65417 K2 IDE: KTOR false positive expect-actual matching error on enum class because of implicit clone() in non-JVM source sets

Analysis API. Code Compilation

  • KT-76457 K2 IDE / KMP Debugger: KISEWA “Cannot compile a common source without a JVM counterpart” on evaluating inline fun from common module inside jvm

Analysis API. FIR

... (truncated)

Commits
  • 9180ce6 Add changelog for 2.4.21-RC
  • 851077b [Serialization] Copy type parameter bounds onto generated serializers (#8421)
  • 1b6b624 [Wasm]: Generate a Kotlin-level cast for bridged lambda functions. (#8404)
  • 3c223c2 Rrr/2.4.20/core docs (#8322)
  • c681c2e [2.4.20] [KT-89285] Stop the xcodebuild logs being output by default (#8277)
  • f0645d1 [2.4.20] [JS] Reorder CompilerConfiguration properties initialization (#8282)
  • f507ecd [JS] Don't try to initialize an external class's companion object
  • c60d7d8 Reflection: fix NoSuchElementException in ConvertFromJava.kt
  • 05d1cde REPL: render correct reflected binding type
  • 5acec47 Scripting: store collected dependencies recursively
  • Additional commits viewable in compare view

Updates org.jetbrains.kotlin.plugin.serialization from 2.4.10 to 2.4.21

Release notes

Sourced from org.jetbrains.kotlin.plugin.serialization's releases.

Kotlin 2.4.21

Changelog

Backend. Wasm

  • KT-89267 K/Wasm: calling a (T) -> R lambda with an argument that isn't a T traps instead of throwing ClassCastException

JVM. Reflection

  • KT-89280 NoSuchElementException in argumentsMakeSenseOnlyForMutableContainer for Java non-static inner class of generic outer class
  • KT-80710 Reflection: change KCallable representation to avoid dependency on K1

JavaScript

  • KT-89449 Kotlin/JS: Member names no longer minified in production
  • KT-89363 KJS. Regular class with companion can't extend external class

Tools. Compiler plugins. Serialization

  • KT-89275 Kotlin/Wasm: Invalid Wasm is emitted for a @Serializable generic class with a class upper bound

Tools. Gradle. Native

  • KT-89285 SwiftPM import results in flooded log
  • KT-86251 K/N: Flaky linkDebugTestLinuxX64 failure with "truncated or malformed archive" on libstdlib-cache.a

Tools. Scripts

  • KT-89247 Kotlin Script: NoClassDefFoundError on 2nd execution with transitive dependency from imported script
  • KT-89220 JSR-223: generic Java bindings break all subsequent eval() calls
  • KT-88458 Audit closeable resource usage
  • KT-88453 VirtualFileScriptSource.text leaks an unclosed file stream — script source file handle held until GC, blocks file deletion on Windows

Kotlin 2.4.21-RC

Changelog

Backend. Wasm

  • KT-89267 K/Wasm: calling a (T) -> R lambda with an argument that isn't a T traps instead of throwing ClassCastException

JVM. Reflection

  • KT-89280 NoSuchElementException in argumentsMakeSenseOnlyForMutableContainer for Java non-static inner class of generic outer class
  • KT-80710 Reflection: change KCallable representation to avoid dependency on K1

JavaScript

  • KT-89449 Kotlin/JS: Member names no longer minified in production
  • KT-89363 KJS. Regular class with companion can't extend external class

... (truncated)

Changelog

Sourced from org.jetbrains.kotlin.plugin.serialization's changelog.

2.4.21

Backend. Wasm

  • KT-89267 K/Wasm: calling a (T) -> R lambda with an argument that isn't a T traps instead of throwing ClassCastException

JVM. Reflection

  • KT-89280 NoSuchElementException in argumentsMakeSenseOnlyForMutableContainer for Java non-static inner class of generic outer class
  • KT-80710 Reflection: change KCallable representation to avoid dependency on K1

JavaScript

  • KT-89449 Kotlin/JS: Member names no longer minified in production
  • KT-89363 KJS. Regular class with companion can't extend external class

Tools. Compiler plugins. Serialization

  • KT-89275 Kotlin/Wasm: Invalid Wasm is emitted for a @Serializable generic class with a class upper bound

Tools. Gradle. Native

  • KT-89285 SwiftPM import results in flooded log
  • KT-86251 K/N: Flaky linkDebugTestLinuxX64 failure with "truncated or malformed archive" on libstdlib-cache.a

Tools. Scripts

  • KT-89247 Kotlin Script: NoClassDefFoundError on 2nd execution with transitive dependency from imported script
  • KT-89220 JSR-223: generic Java bindings break all subsequent eval() calls
  • KT-88458 Audit closeable resource usage
  • KT-88453 VirtualFileScriptSource.text leaks an unclosed file stream — script source file handle held until GC, blocks file deletion on Windows

2.4.20

Analysis API

  • KT-86546 Check suspicious when over ConeKotlinType in ConeTypeCompatibilityChecker
  • KT-85418 Implement an API for accessing deserialized file annotations in Analysis API
  • KT-74448 K2. False positive MISSING_DEPENDENCY_SUPERCLASS in LinkedListTest.kt, kotlinx.coroutines
  • KT-85856 containingSymbol of constructor property differs for local and non-local classes
  • KT-65417 K2 IDE: KTOR false positive expect-actual matching error on enum class because of implicit clone() in non-JVM source sets

Analysis API. Code Compilation

  • KT-76457 K2 IDE / KMP Debugger: KISEWA “Cannot compile a common source without a JVM counterpart” on evaluating inline fun from common module inside jvm

Analysis API. FIR

... (truncated)

Commits
  • 9180ce6 Add changelog for 2.4.21-RC
  • 851077b [Serialization] Copy type parameter bounds onto generated serializers (#8421)
  • 1b6b624 [Wasm]: Generate a Kotlin-level cast for bridged lambda functions. (#8404)
  • 3c223c2 Rrr/2.4.20/core docs (#8322)
  • c681c2e [2.4.20] [KT-89285] Stop the xcodebuild logs being output by default (#8277)
  • f0645d1 [2.4.20] [JS] Reorder CompilerConfiguration properties initialization (#8282)
  • f507ecd [JS] Don't try to initialize an external class's companion object
  • c60d7d8 Reflection: fix NoSuchElementException in ConvertFromJava.kt
  • 05d1cde REPL: render correct reflected binding type
  • 5acec47 Scripting: store collected dependencies recursively
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): Bump the gradle group across 1 directory with 10 updates
5b49cda 
Bumps the gradle group with 10 updates in the /sdk/android directory:

| Package | From | To |
| --- | --- | --- |
| androidx.core:core-ktx | `1.19.0` | `1.19.1` |
| androidx.appcompat:appcompat | `1.7.0` | `1.8.0` |
| [com.squareup.okhttp3:okhttp](https://github.com/lysine-dev/okhttp) | `5.4.0` | `5.5.1` |
| [org.jetbrains.kotlinx:kotlinx-serialization-json](https://github.com/Kotlin/kotlinx.serialization) | `1.11.0` | `1.12.0` |
| [com.nimbusds:nimbus-jose-jwt](https://bitbucket.org/connect2id/nimbus-jose-jwt) | `10.9.1` | `10.10` |
| org.jetbrains.kotlinx:kotlinx-coroutines-test | `1.11.0` | `1.12.0` |
| [com.squareup.okhttp3:mockwebserver](https://github.com/lysine-dev/okhttp) | `5.4.0` | `5.5.1` |
| com.android.library | `9.3.1` | `9.5.0` |
| [org.jetbrains.kotlin.android](https://github.com/JetBrains/kotlin) | `2.4.10` | `2.4.21` |
| [org.jetbrains.kotlin.plugin.serialization](https://github.com/JetBrains/kotlin) | `2.4.10` | `2.4.21` |



Updates `androidx.core:core-ktx` from 1.19.0 to 1.19.1

Updates `androidx.appcompat:appcompat` from 1.7.0 to 1.8.0

Updates `com.squareup.okhttp3:okhttp` from 5.4.0 to 5.5.1
- [Changelog](https://github.com/lysine-dev/okhttp/blob/main/CHANGELOG.md)
- [Commits](lysine-dev/okhttp@parent-5.4.0...parent-5.5.1)

Updates `org.jetbrains.kotlinx:kotlinx-serialization-json` from 1.11.0 to 1.12.0
- [Release notes](https://github.com/Kotlin/kotlinx.serialization/releases)
- [Changelog](https://github.com/Kotlin/kotlinx.serialization/blob/master/CHANGELOG.md)
- [Commits](Kotlin/kotlinx.serialization@v1.11.0...v1.12.0)

Updates `com.nimbusds:nimbus-jose-jwt` from 10.9.1 to 10.10
- [Changelog](https://bitbucket.org/connect2id/nimbus-jose-jwt/src/master/CHANGELOG.txt)
- [Commits](https://bitbucket.org/connect2id/nimbus-jose-jwt/branches/compare/10.10..10.9.1)

Updates `org.jetbrains.kotlinx:kotlinx-coroutines-test` from 1.11.0 to 1.12.0

Updates `com.squareup.okhttp3:mockwebserver` from 5.4.0 to 5.5.1
- [Changelog](https://github.com/lysine-dev/okhttp/blob/main/CHANGELOG.md)
- [Commits](lysine-dev/okhttp@parent-5.4.0...parent-5.5.1)

Updates `com.android.library` from 9.3.1 to 9.5.0

Updates `org.jetbrains.kotlin.android` from 2.4.10 to 2.4.21
- [Release notes](https://github.com/JetBrains/kotlin/releases)
- [Changelog](https://github.com/JetBrains/kotlin/blob/master/ChangeLog.md)
- [Commits](JetBrains/kotlin@v2.4.10...v2.4.21)

Updates `org.jetbrains.kotlin.plugin.serialization` from 2.4.10 to 2.4.21
- [Release notes](https://github.com/JetBrains/kotlin/releases)
- [Changelog](https://github.com/JetBrains/kotlin/blob/master/ChangeLog.md)
- [Commits](JetBrains/kotlin@v2.4.10...v2.4.21)

---
updated-dependencies:
- dependency-name: androidx.core:core-ktx
  dependency-version: 1.19.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gradle
- dependency-name: androidx.appcompat:appcompat
  dependency-version: 1.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle
- dependency-name: com.squareup.okhttp3:okhttp
  dependency-version: 5.5.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle
- dependency-name: org.jetbrains.kotlinx:kotlinx-serialization-json
  dependency-version: 1.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle
- dependency-name: com.nimbusds:nimbus-jose-jwt
  dependency-version: '10.10'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle
- dependency-name: org.jetbrains.kotlinx:kotlinx-coroutines-test
  dependency-version: 1.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle
- dependency-name: com.squareup.okhttp3:mockwebserver
  dependency-version: 5.5.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle
- dependency-name: com.android.library
  dependency-version: 9.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle
- dependency-name: org.jetbrains.kotlin.android
  dependency-version: 2.4.21
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gradle
- dependency-name: org.jetbrains.kotlin.plugin.serialization
  dependency-version: 2.4.21
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gradle
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Nov 1, 2026
@dependabot
dependabot Bot requested a review from StringKe as a code owner November 1, 2026 15:19
@dependabot @github

dependabot Bot commented on behalf of github Nov 1, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: native-sdk. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@StringKe StringKe Awaiting requested review from StringKe StringKe is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants