chore(deps): bump the gradle group across 1 directory with 8 updates

[dependabot]

Bumps the gradle group with 8 updates in the / directory:

Package	From	To
org.bouncycastle:bcpg-jdk18on	1.84	1.86
org.bitbucket.b_c:jose4j	0.9.6	0.9.7
gradle-wrapper	9.6.1	9.7.1
androidx.navigation:navigation-compose	2.9.8	2.10.1
com.squareup.okhttp3:okhttp	5.4.0	5.5.0
com.squareup.okhttp3:mockwebserver3-junit4	5.4.0	5.5.0
com.squareup.okhttp3:mockwebserver3-junit4	5.4.0	5.5.0
com.mikepenz:multiplatform-markdown-renderer-m3	0.43.0	0.45.0
com.google.devtools.ksp	2.3.10	2.3.12

Updates org.bouncycastle:bcpg-jdk18on from 1.84 to 1.86

Changelog

Sourced from org.bouncycastle:bcpg-jdk18on's changelog.

Bouncy Castle Crypto Package - Release Notes

1.0 Introduction

The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. The package is organised so that it contains a light-weight API suitable for use in any environment (including the J2ME) with the additional infrastructure to conform the algorithms to the JCE framework.

2.0 Release History

2.1.1 Version

Release: 1.87
Date: 2026, TBD

2.1.2 Defects Fixed

• A KeyAgreement asked for its shared secret before doPhase returned data rather than refusing. javax.crypto.KeyAgreement specifies IllegalStateException for that state, but nothing in the provider tracked it, so each SPI handed back whatever its result field held: for Diffie-Hellman that was the private value itself - engineInit seeded result with x, so generateSecret() returned the private exponent padded to the prime's length and generateSecret("AES") an all-zero key taken from that padding - while ECDH returned null and its named-algorithm overload raised NullPointerException. BaseAgreementSpi now records whether a doPhase has completed the agreement since the last init and refuses the request with an IllegalStateException naming the algorithm, so every family in the provider - DH, ECDH and ECMQV, the SM2 exchange, both ECGOST families, XDH, SM9 and NewHope - answers the same way, and the DH SPI no longer holds the private value in that field at all.

• Mac.getInstance and KeyGenerator.getInstance by the HMAC SHA-512/224 and SHA-512/256 object identifiers (1.2.840.113549.2.12 and .13) failed, although the same algorithms resolved by name and the matching SecretKeyFactory aliases were registered: the SHA512 mappings called addHMACAlgorithm for the two truncated variants without the addHMACAlias that registers their OIDs against Mac and KeyGenerator. Both are now aliased, as every other HMAC in that class already was.

• A KTSParameterSpec naming an HKDF key-derivation function with a parameters field - a form the provider does not service - was accepted at Cipher init and then failed out of wrap or unwrap with an unchecked IllegalStateException neither method declares. The KTS key-wrapping Ciphers (ML-KEM, Classic McEliece, FrodoKEM, the composite KEM and RSA-KEM) now validate the spec's KDF when they take it, reporting an unserviceable one as the InvalidAlgorithmParameterException engineInit declares, which is what the javax.crypto.KEM services already did through KdfUtil.resolveKemSpec.

• A DTLS handshake deadlocked when a handshake message ahead of the peer's ChangeCipherSpec (a client's CertificateVerify, say) was lost while the ChangeCipherSpec and Finished behind it arrived: the record layer moved its read epoch on at the ChangeCipherSpec and then discarded every retransmission of the lost message as belonging to the old epoch, whose records are only accepted once the handshake has completed. Each side then waited on the other until a handshake timeout, if one was configured, ended it. Every client-authenticated handshake, and every handshake in which the server issues a NewSessionTicket, was exposed. Until the handshake completes, handshake records from the current epoch are now still accepted after the read epoch has moved on, and each message is checked against the epoch of the record that carried it. The DTLS loopback tests now run their handshakes at 10% datagram loss in each direction, with a client-authenticated handshake at 25%.

• The lightweight SubjectPublicKeyInfoFactory and PrivateKeyInfoFactory encoded a GOST R 34.10-2012 key on one of the legacy CryptoPro curves under id-GostR3410-2001, although RFC 9215 sec. 4.2 permits those curves for 2012 keys. The digestParamSet now decides: a GOST R 34.11-94 parameter set means 2001 (RFC 4491 sec. 2.3.2), a GOST R 34.11-2012 digest or none means 2012 with 256/512 taken from the curve field size, and any other value is rejected. GOST3410PublicKeyAlgParameters treats digestParamSet as OPTIONAL on both read and write per RFC 9215, and PrivateKeyInfoFactory now passes attributes through for ECGOST3410 keys (bc-csharp github #707).

• The name-constraint host canonicalisation removed a single RFC 1034 root-label dot, the only empty label a name may legally carry, but nothing refused the ones that are not legal: a dNSName, rfc822Name host or uniformResourceIdentifier host such as "example.com.." kept a phantom empty label after the strip and so matched no constraint at all, escaping an excluded subtree naming the host it appears to carry. A tested name whose host carries an empty label - a second trailing dot, a doubled dot or a leading dot - is now refused outright wherever a constraint of that type is in force, rather than canonicalised into a name it is not: removing the extra dots would decide on the caller's behalf that "example.com.." names example.com, which is not how a consumer resolving or comparing the name reads it, and refusing fails closed in both directions where canonicalising would newly admit such a name under a permitted subtree. The single trailing dot is canonicalised as before, a bare "." remains the root label rather than an empty one, and the guard is scoped to the host, so the doubled dot a quoted local part may legally carry is unaffected. Constraints are untouched - one may still begin with a dot, which is how this implementation spells "subdomains only" (github PR #2436).

2.1.3 Additional Features and Functionality

2.1.4 Additional Notes

• The sources and javadoc jars of the Ant-built distributions (jdk14, jdk15to18 and jdk13) no longer carry test material. Each module's javadoc target copies the package documentation it needs - org/bouncycastle///*.html - back into the module source directory that has already been compiled from, and zip-src zips that directory afterwards, so every test package's package.html arrived in the sources jar by that route; javadoc-util additionally copied org/bouncycastle/asn1/isismtt//*.java, which put test classes into the bcutil javadoc as generated pages, and javadoc-pg deliberately copied the gpg and bcpg test sources in order to document them. Separately the source copies excluded test material only one directory deep and only for *.java, because Ant reads ** as an any-depth wildcard just where it is a whole path segment, so anything nested further or with another extension - the PEM certificate fixtures under org/bouncycastle/est/test/san corrected in 1.86, and an ICAO master list under org/bouncycastle/asn1/icao/test - went through. The source and javadoc copies of every module now exclude test directories at any depth, and javadoc-pg no longer documents the test packages. org.bouncycastle.util.test is unaffected and still ships in the bcprov binary, sources and javadoc jars, as it does from the Gradle build: it is the SimpleTest framework the light-weight API's own test classes are written against, not test material of the distribution. No binary changes - the classes and resources of every Ant-built jar are identical to those of the 1.86 release - and the Gradle-built jdk18on artifacts never carried any of this.

2.2.1 Version

Release: 1.86
Date: 2026, 11th September.

2.2.2 Defects Fixed

• The high-level OpenPGP API let a subkey inherit the primary key's Key Flags when its own Subkey Binding signature carried none, so a subkey bound with no flags counted as signing-capable for one check while the cross-certification check RFC 9580 sec. 5.2.1.8 requires of a signing subkey saw none and was skipped - letting a third party's public signing subkey be bound to an attacker's primary key and that party's genuine signatures verify under the attacker's identity. Flags are no longer inherited (CVE-2026-71887).
• The high-level OpenPGP API used a version 6 key carrying no valid Direct Key signature, falling back to the primary user ID binding as it correctly does for version 4. RFC 9580 sec. 5.2.3.10 requires the opposite, and since a v6 certificate carries its expiration and preferences there, stripping that one packet silently dropped them - the certificate went on offering subkeys of a key set to expire. isBoundBy now requires a valid Direct Key self-signature before any v6 component is treated as bound; version 4 is unaffected.
• The high-level OpenPGP API ignored the OpenPGPPolicy a caller had configured when verifying signatures on an inline message: OpenPGPMessageInputStream took the policy from the implementation's own default rather than from the processor doing the verification, so a hardened policy had no bearing on acceptance and getSignatures() reported isTestedCorrect() true for a signature that policy rejects. Both the one-pass and prefixed-signature paths now read the configured policy.
• The high-level OpenPGP API went on offering the subkeys of a certificate whose primary key had expired, the binding check evaluating only a subkey's own Subkey Binding signature - so the certificate contradicted itself, reporting the primary unbound while still handing out its subkeys. The primary key's expiration now applies to the whole certificate, as GnuPG and Sequoia treat it, and a subkey no longer inherits the primary's validity period, which RFC 9580 sec. 5.2.3.13 counts from the creation time of the key the carrying signature is made on.
• OpenPGPDocumentSignature.isValidAt(Date) reported a data signature as valid past the signature's own Signature Expiration Time (RFC 9580 sec. 5.2.3.18): it checked that the signature was correct and the issuing key bound and signing-capable at that date, but never the signature's own expiration, so it disagreed with isEffectiveAt() on the same object and with its own javadoc. isValid() and isValid(policy), which evaluate at creation time, are unchanged.
• The lightweight LMSSigner and HSSSigner refused a key wrapped in ParametersWithRandom, which is how BcContentSignerBuilder passes one once setSecureRandom() has been called, so BcHssLmsContentSignerBuilder failed with "Incorrect Key Parameters" and the two signers raised ClassCastException. All three now unwrap it, as the ML-DSA and SLH-DSA signers already did; the random is accepted and ignored, LMS deriving its message randomiser deterministically from the seed and one-time index.
• LMS signature verification did not apply two checks RFC 8554 sec. 5.4.2 requires before a signature is processed: step 2g, refusing a signature whose LMS typecode is not the public key's - without it a signature claiming a height-25 parameter set drove a 25-level computation against a height-5 key - and step 2i, refusing a leaf number outside the tree. Neither was a forgery, but both are attacker-chosen work the specification says to refuse up front. Both are now checked.
• The LMS and HSS key parameter classes now apply at construction the checks their decoders apply, so a key built directly cannot be one the decoder would refuse: LMSPrivateKeyParameters accepted an identifier of any length where the decoder reads exactly 16 bytes, and left q, maxQ and the seed length unchecked, while HSSPrivateKeyParameters checked neither its level count nor that it had a component key and chaining signature per level. The decoders now report a bad version or seed length as IOException rather than IllegalStateException.
• In the LMS JCE layer, LMSKeyGenParameterSpec.fromNames knew all twenty LMS parameter-set names but only four of the sixteen LM-OTS ones, so none of the SP 800-208 n24 or SHAKE sets could be named; all sixteen are now present. initialize(int, SecureRandom) now reports InvalidParameterException as the JCA specifies, and BCLMSPrivateKey.getIndex takes the exhaustion check and the index read under one monitor.
• KeyPairGenerator.initialize(int, SecureRandom) is documented to raise InvalidParameterException when the key size is not one the generator supports, and thirty of them raised a bare IllegalArgumentException instead. Every generator in BCPQC, and the ML-DSA, ML-KEM, SLH-DSA, Classic McEliece, FrodoKEM, NTRU and composite ones in the BC provider, now raise the documented type - which extends IllegalArgumentException, so existing catches still match. The two RSA generators translate the lightweight refusal through a new SecurityExceptions.invalidParameterException factory.

... (truncated)

Commits

• See full diff in compare view

Updates org.bitbucket.b_c:jose4j from 0.9.6 to 0.9.7

Changelog

Sourced from [org.bitbucket.b_c:jose4j's changelog](https://bitbucket.org/b_c/jose4j/src/master/Release Notes.md).

jose4j-0.9.7 - September 9, 2026

• update test dependencies
• cap the size of numbers for better resource utilization in JSON processing (hat tip to Mike Read for the tip)
• fix some typos and other issues in javadoc and log messages
• updates for newer maven central publishing

Commits

• 756257e [maven-release-plugin] prepare for next development iteration
• 5db177b Look for Tag mismatch with no "!" b/c apparently maybe that changed
• 71a6650 Merged in strict-aud-validation (pull request #26)
• 05ce887 Compiler source and target to 1.8
• f7c6da8 Update slf4j, bouncycastle, and mockito dependencies
• 3ac5eb4 Merged in fix-comment-typos (pull request #27)
• a87874c Fix stated default in Get.setResponseBodySizeLimit javadoc
• 51bdce2 fix log message arg number missmatch
• 7d8c470 Another log message arg number mismatch with a different fix
• 908a55e cap the size of numbers for better resource utilization in JSON processing (h...
• Additional commits viewable in compare view

Updates gradle-wrapper from 9.6.1 to 9.7.1

Release notes

Sourced from gradle-wrapper's releases.

9.7.1

The Gradle team is excited to announce Gradle 9.7.1.

This is a patch release for 9.7.0. We recommend using 9.7.1 instead of 9.7.0.

Here are the highlights of 9.7.0 release:

• Isolated Projects graduates to incubating
• Broader Configuration Cache compatibility
• Resilient Sync helps you fix broken builds
• More source locations in problem reports

Read the Release Notes

We would like to thank the following community members for their contributions to this release of Gradle: Adam, Aman Gautam, Aman Kumar, Anton Dubrouski, Aurimas, gbhavya07, Josh Friend, nicklauslittle-gov, Pragati, project516, Qin Mi, Ravi, sk-reddy17, Suvrat Acharya, Yongshun Ye.

Upgrade instructions

Switch your build to use Gradle 9.7.1 by updating your wrapper:

./gradlew :wrapper --gradle-version=9.7.1 && ./gradlew :wrapper

See the Gradle 9.x upgrade guide to learn about deprecations, breaking changes and other considerations when upgrading.

For Java, Groovy, Kotlin and Android compatibility, see the full compatibility notes.

Reporting problems

If you find a problem with this release, please file a bug on GitHub Issues adhering to our issue guidelines. If you're not sure you're encountering a bug, please use the forum.

We hope you will build happiness with Gradle, and we look forward to your feedback via Twitter or on GitHub.

9.7.0

The Gradle team is excited to announce Gradle 9.7.0.

... (truncated)

Commits

• 92f0512 update fixed issues for 9.7.1 (#38892)
• 820ee75 update fixed issues for 9.7.1
• 82c23f9 Fix annotation parameter ordering problem in KTS (#38878)
• ef11a72 Fix annotation parameter ordering issue
• bb0d8a9 Make relevant tests polyglot (run for multiple DSLs)
• 336e129 Update signing configuration (#38874)
• 4bdf0da Update signing configuration
• cd9b92c List issues resolved in 9.7.1 (#38839)
• 5f4e381 List issues resolved in 9.7.1
• 1e08ab5 Keep type-use annotations in extracted ABI classes (#38810)
• Additional commits viewable in compare view

Updates androidx.navigation:navigation-compose from 2.9.8 to 2.10.1

Updates com.squareup.okhttp3:okhttp from 5.4.0 to 5.5.0

Changelog

Sourced from com.squareup.okhttp3:okhttp's changelog.

Version 5.5.0

2026-08-16

This release introduces opt-in support for [Encrypted Client Hello (ECH)]. This new feature improves user privacy by encrypting domain names in transit. With regular TLS, your coffee shop’s Wi-Fi router can see that you’re visiting wikipedia.com, but it cannot see which page you’re looking at. With ECH, the router observes only the IP address. This additional privacy is most effective on sites hosted by big CDNs because the IP address doesn’t imply a particular website.

This requires ECH support in the platform’s TLS stack. Today this is only Android 17 (API 37, released June 2026). When other TLS stacks add ECH support, we'll integrate them.

ECH took a lot of work to implement because the encryption keys are published over DNS in the [HTTPS resource record], and we needed to write new code to fetch these records. This release includes a major update to OkHttp’s DNS API: it now supports multiple resource record types (not just IP addresses!), asynchronous streaming results, and in-memory caching.

To opt in, you can use DnsOverHttps:

// DnsOverHttps itself uses OkHttpClient. Build both clients upon the
// same bootstrap client so they share a connection pool and dispatcher.
val bootstrapClient = OkHttpClient()
// This sample uses Cloudflare's 1.1.1.1 DnsOverHttps service.
val client = bootstrapClient.newBuilder()
.dns(DnsOverHttps.Builder()
.client(bootstrapClient)
.url("https://1.1.1.1/dns-query".toHttpUrl())
.build())
.build()

You could also opt in with our new AndroidDns API. Unfortunately, the privacy benefits of ECH are thwarted because its DNS queries are not encrypted by default.

// AndroidDns fetches the HTTPS DNS resource records necessary for ECH.
val client = OkHttpClient.Builder()
  .dns(AndroidDns())
  .build()

• New: OkHttp artifacts are now signed with our [new signing key]. This project and three sibling projects ([Retrofit], [Okio], and [SQLDelight]) recently joined [the Commonhaus Foundation].
• Fix: MockWebServer’s @StartStop annotation now supports @Nested JUnit 5 tests.
• Fix: Our default TLS hostname verifier now reject hosts that fail IP canonicalization.
• Fix: Closing a multipart part's sink no longer closes the entire request body.
• Fix: Flush HTTP/1 request bodies before detaching the timeout. We had a bug where timeouts

... (truncated)

Commits

• a94bdf1 Prepare for release 5.5.0.
• ecc3b05 Use a fixed size for DoH request body (#9687)
• 9926082 Revert "Use a fixed size for DoH request body" (#9686)
• 0070c2e Use a fixed size for DoH request body
• 1576453 Order ServiceMetadata records per the spec (#9683)
• fb582e9 Flip wiring of Dns.SYSTEM (#9682)
• 4e884ab retryOnConnectionFailure doesn't impact ECH retries (#9681)
• 0433cee Only one contributing.md doc (#9678)
• a2cf5aa Don't recover after an ECH public_name fails to verify (#9680)
• 5410de9 Test ECH + HTTP proxy (#9671)
• Additional commits viewable in compare view

Updates com.squareup.okhttp3:mockwebserver3-junit4 from 5.4.0 to 5.5.0

Changelog

Sourced from com.squareup.okhttp3:mockwebserver3-junit4's changelog.

Version 5.5.0

2026-08-16

This release introduces opt-in support for [Encrypted Client Hello (ECH)]. This new feature improves user privacy by encrypting domain names in transit. With regular TLS, your coffee shop’s Wi-Fi router can see that you’re visiting wikipedia.com, but it cannot see which page you’re looking at. With ECH, the router observes only the IP address. This additional privacy is most effective on sites hosted by big CDNs because the IP address doesn’t imply a particular website.

This requires ECH support in the platform’s TLS stack. Today this is only Android 17 (API 37, released June 2026). When other TLS stacks add ECH support, we'll integrate them.

ECH took a lot of work to implement because the encryption keys are published over DNS in the [HTTPS resource record], and we needed to write new code to fetch these records. This release includes a major update to OkHttp’s DNS API: it now supports multiple resource record types (not just IP addresses!), asynchronous streaming results, and in-memory caching.

To opt in, you can use DnsOverHttps:

// DnsOverHttps itself uses OkHttpClient. Build both clients upon the
// same bootstrap client so they share a connection pool and dispatcher.
val bootstrapClient = OkHttpClient()
// This sample uses Cloudflare's 1.1.1.1 DnsOverHttps service.
val client = bootstrapClient.newBuilder()
.dns(DnsOverHttps.Builder()
.client(bootstrapClient)
.url("https://1.1.1.1/dns-query".toHttpUrl())
.build())
.build()

You could also opt in with our new AndroidDns API. Unfortunately, the privacy benefits of ECH are thwarted because its DNS queries are not encrypted by default.

// AndroidDns fetches the HTTPS DNS resource records necessary for ECH.
val client = OkHttpClient.Builder()
  .dns(AndroidDns())
  .build()

• New: OkHttp artifacts are now signed with our [new signing key]. This project and three sibling projects ([Retrofit], [Okio], and [SQLDelight]) recently joined [the Commonhaus Foundation].
• Fix: MockWebServer’s @StartStop annotation now supports @Nested JUnit 5 tests.
• Fix: Our default TLS hostname verifier now reject hosts that fail IP canonicalization.
• Fix: Closing a multipart part's sink no longer closes the entire request body.
• Fix: Flush HTTP/1 request bodies before detaching the timeout. We had a bug where timeouts

... (truncated)

Commits

• a94bdf1 Prepare for release 5.5.0.
• ecc3b05 Use a fixed size for DoH request body (#9687)
• 9926082 Revert "Use a fixed size for DoH request body" (#9686)
• 0070c2e Use a fixed size for DoH request body
• 1576453 Order ServiceMetadata records per the spec (#9683)
• fb582e9 Flip wiring of Dns.SYSTEM (#9682)
• 4e884ab retryOnConnectionFailure doesn't impact ECH retries (#9681)
• 0433cee Only one contributing.md doc (#9678)
• a2cf5aa Don't recover after an ECH public_name fails to verify (#9680)
• 5410de9 Test ECH + HTTP proxy (#9671)
• Additional commits viewable in compare view

Updates com.squareup.okhttp3:mockwebserver3-junit4 from 5.4.0 to 5.5.0

Changelog

Sourced from com.squareup.okhttp3:mockwebserver3-junit4's changelog.

Version 5.5.0

2026-08-16

This release introduces opt-in support for [Encrypted Client Hello (ECH)]. This new feature improves user privacy by encrypting domain names in transit. With regular TLS, your coffee shop’s Wi-Fi router can see that you’re visiting wikipedia.com, but it cannot see which page you’re looking at. With ECH, the router observes only the IP address. This additional privacy is most effective on sites hosted by big CDNs because the IP address doesn’t imply a particular website.

This requires ECH support in the platform’s TLS stack. Today this is only Android 17 (API 37, released June 2026). When other TLS stacks add ECH support, we'll integrate them.

ECH took a lot of work to implement because the encryption keys are published over DNS in the [HTTPS resource record], and we needed to write new code to fetch these records. This release includes a major update to OkHttp’s DNS API: it now supports multiple resource record types (not just IP addresses!), asynchronous streaming results, and in-memory caching.

To opt in, you can use DnsOverHttps:

// DnsOverHttps itself uses OkHttpClient. Build both clients upon the
// same bootstrap client so they share a connection pool and dispatcher.
val bootstrapClient = OkHttpClient()
// This sample uses Cloudflare's 1.1.1.1 DnsOverHttps service.
val client = bootstrapClient.newBuilder()
.dns(DnsOverHttps.Builder()
.client(bootstrapClient)
.url("https://1.1.1.1/dns-query".toHttpUrl())
.build())
.build()

You could also opt in with our new AndroidDns API. Unfortunately, the privacy benefits of ECH are thwarted because its DNS queries are not encrypted by default.

// AndroidDns fetches the HTTPS DNS resource records necessary for ECH.
val client = OkHttpClient.Builder()
  .dns(AndroidDns())
  .build()

• New: OkHttp artifacts are now signed with our [new signing key]. This project and three sibling projects ([Retrofit], [Okio], and [SQLDelight]) recently joined [the Commonhaus Foundation].
• Fix: MockWebServer’s @StartStop annotation now supports @Nested JUnit 5 tests.
• Fix: Our default TLS hostname verifier now reject hosts that fail IP canonicalization.
• Fix: Closing a multipart part's sink no longer closes the entire request body.
• Fix: Flush HTTP/1 request bodies before detaching the timeout. We had a bug where timeouts

... (truncated)

Commits

• a94bdf1 Prepare for release 5.5.0.
• ecc3b05 Use a fixed size for DoH request body (#9687)
• 9926082 Revert "Use a fixed size for DoH request body" (#9686)
• 0070c2e Use a fixed size for DoH request body
• 1576453 Order ServiceMetadata records per the spec (#9683)
• fb582e9 Flip wiring of Dns.SYSTEM (#9682)
• 4e884ab retryOnConnectionFailure doesn't impact ECH retries (#9681)
• 0433cee Only one contributing.md doc (#9678)
• a2cf5aa Don't recover after an ECH public_name fails to verify (#9680)
• 5410de9 Test ECH + HTTP proxy (#9671)
• Additional commits viewable in compare view

Updates com.mikepenz:multiplatform-markdown-renderer-m3 from 0.43.0 to 0.45.0

Release notes

Sourced from com.mikepenz:multiplatform-markdown-renderer-m3's releases.

v0.45.0

🐛 Fixes

• Remove double bottom padding from MarkdownBulletList
  • PR: #626
• fix: render GFM math spans as text instead of dropping them
  • PR: #627

💬 Other

• chore(deps): update github/codeql-action action to v4.37.7
  • PR: #624
• chore(deps): update mikepenz/action-gh-release action to v3.1.0
  • PR: #628
• chore(deps): update dependencies
  • PR: #629

Contributors:

• @​renovate-mike[bot], @​stfbee, @​thejdubb02, @​mikepenz

v0.44.0

🚀 Features

• feat: add GitHub alert banner component
  • PR: #603
• fix: render email autolinks (#608)
  • PR: #610
• fix(alert): honor explicit title color and horizontal content padding
  • PR: #612
• ci: add OpenSSF Scorecard and scope workflow token permissions
  • PR: #618

💬 Other

• chore(deps): update github actions updates
  • PR: #594
• chore(deps): update actions/checkout action to v7
  • PR: #596
• chore(deps): update gradle to v9.6.0
  • PR: #595
• chore(deps): update github actions updates
  • PR: #601
• chore(deps): update actions/cache action to v6
  • PR: #602
• fix(deps): update ktor monorepo to v3.5.1
  • PR: #600
• chore(deps): update gradle to v9.6.1
  • PR: #599
• chore(deps): update mcr.microsoft.com/devcontainers/java:3-21 docker digest to d397e49

... (truncated)

Commits

• 3bf1b9b Merge pull request #631 from mikepenz/develop
• 57813b1 - [release] v0.45.0
• 830e819 fix: expose resolveImageLink, resolveImageAlt, ImageAltTooltip as public
• d21efe8 Merge pull request #629 from mikepenz/chore/update-dependencies-0.20.0
• 2972b8d chore(deps): update dependencies
• b2cdcaa Merge pull request #627 from thejdubb02/fix/gfm-math-dropped
• 6e9c0af Merge pull request #626 from stfbee/feat/double-padding
• 42a9e91 chore(deps): update mikepenz/action-gh-release action to v3.1.0 (#628)
• f0ed7ef fix: render GFM math spans as text instead of dropping them
• 64b5677 sample:recordPaparazzi screenshots
• Additional commits viewable in compare view

Updates com.google.devtools.ksp from 2.3.10 to 2.3.12

Release notes

Sourced from com.google.devtools.ksp's releases.

2.3.12

What's Changed

Migrating Processors to Support Backing Fields

This release introduces support for explicit backing fields (#2873), which may now be returned by Resolver.getSymbolsWithAnnotation. To prevent breaking existing processors, new language features require an explicit opt-in.

More generally, the KSP API now explicitly models backing fields for properties. The following is an exhaustive list of functions in KSP API where processor may observe the change after opting in:

• Resolver.getSymbolsWithAnnotation: The function now returns a KSBackingField if the given annotation targeted a field. Previously, if a field were targeted, the function would return a KSProperty.
• Resolver.effectiveJavaModifiers: The function returns fewer modifiers for a KSPropertyDeclaration if it has a backing field, since most of the JVM-specific annotations apply to the backing field. If you are interested in the JVM modifiers, you should call the function with the KSBackingField obtained from the property instead.

Additionally, KSP now models Java fields as properties that always have backing fields. Some of the modifiers now apply to the backing field instead.

Processors adapting to new features must opt in via both of the following steps simultaneously (failing to do both may lead to undefined behavior):

1. The processor should call the registerProcessorForNewFeatures function in SymbolProcessorEnvironment immediately when created (and only once). Example: AbstractTestProcessor.kt#L30
2. All implementations of KSVisitor should move to KSVisitorNext. If their processor code does not directly implement the interface but instead extends one of the KSP-provided visitors (such as KSTopDownVisitor), they should instead extend KSTopDownVisitor(enableNewFeatures = true) and override visitBackingField depending on their code and needs.

Let us know if you run into unexpected behavior!

Bug Fixes

• Fix Resolver.getDeclarationsFromPackage returning incomplete declarations from KLibs in Kotlin Multiplatform (#2396)
• Fix KSP CLI process hanging indefinitely when a processor throws an unhandled exception (#3120)
• Fix implicit task dependency error between KSP and Android Lint in Android KMP (#3128)
• Fix NullPointerException by registering PluginProblemReporter as an application service (#3140)
• Do not mark companion objects as JAVA_STATIC in Resolver.effectiveJavaModifiers (#3125)
• Fix JAVA_STATIC modifier resolution for @​JvmStatic members in Resolver.effectiveJavaModifiers (#3124)
• Update minimum supported Android Gradle Plugin (AGP) version to 8.12.0 (#3149)

New Contributors

Thanks to @​KlyneChrysler, @​budindepunk, and everyone who reported bugs and participated in discussions!

Full Changelog: google/ksp@2.3.11...2.3.12

2.3.11

What's Changed

• Support org.gradle.isolated-projects for project isolation (#3051)
• Fix premature kspDebugAndroidTest task skipping on Android library modules (#3050)
• Fix missing parent declaration exception for @NotNull annotations during incremental compilation (#3030)
• Clean output directories instead of skipping tasks when processor classpath transitions to empty (#3046)
• Fix build cache misses by marking KspGradleConfig.logLevel as @Internal (#3039)
• Add org.gradle.isolated-projects=true to KSP Gradle properties reference table (#3076)
• Add KSP Gradle properties reference table to README documentation (#3070)
• Document collection values in KSValueArgument.value (#3069)
• Update error messaging for ksp.useKSP2 deprecation notice (#3066)

Contributors

• Thanks to @​simonlebras, @​ChristianKatzmann, @​Yong-yuan-X, @​bacecek, @​KlyneChrysler, @​Shaurya2k06, and everyone who reported bugs and participated in discussions!

Full Changelog: google/ksp@2.3.10...2.3.11

Commits

• a3c3859 Format Resolver file
• a614317 Fix grammatical errors in Resolver doc comments
• c19f255 Merge equal EXPECT NEXT and EXPECT CURRENT in javaBackingFieldUsedInKotlin
• d3df886 Add test for getting default annotation values in KMP
• 3bcac20 Mark testJavaBackingFieldUsedInKotlin as fixed
• e74bb5f Update expected test output in libOrigins
• c9b1d40 Use KSSyntheticJavaBackingFieldImpl in KSPropertyDeclarationImpl
• afefe15 Add KSSyntheticJavaBackingFieldImpl
• 2da07c1 Add test for missing synthetic Java fields
• 7033530 Fix visibility modifiers for Kotlin-based backing fields
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.