From f9a1b30793449056f0d30ae12d966b7abd719101 Mon Sep 17 00:00:00 2001 From: Daz DeBoer Date: Sat, 4 Jul 2026 17:35:12 -0600 Subject: [PATCH] Upgrade shadow to 9.4.3 and drop now-redundant vulnerability constraints Bump com.gradleup.shadow 9.2.2 -> 9.4.3, the latest release. It builds and tests cleanly on the existing Gradle 8.14.4, so no Gradle bump is required and Gradle 5 runtime compatibility is unaffected. Shadow 9.4.3 now ships patched transitive dependencies (commons-io 2.22.0, log4j-core 2.26.0), so the buildscript constraints that forced newer versions are redundant. Remove the buildscript block and the apache-log4j-core catalog entry (the only consumer of the constraint). apache-commons-io is retained as it is still used by plugin-test. Co-Authored-By: Claude Opus 4.8 (1M context) --- gradle/libs.versions.toml | 3 +-- plugin/build.gradle.kts | 15 --------------- 2 files changed, 1 insertion(+), 17 deletions(-) diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index 8a93661..e9ab4ff 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -8,7 +8,6 @@ jackson-databind = { group = "com.fasterxml.jackson.core", name = "jackson-datab jackson-parameter-names = { group = "com.fasterxml.jackson.module", name = "jackson-module-parameter-names" } apache-commons-io = { group = "commons-io", name = "commons-io", version = "2.21.0" } -apache-log4j-core = { group = "org.apache.logging.log4j", name = "log4j-core", version = "2.25.4" } github-packageurl = { group = "com.github.package-url", name = "packageurl-java", version = "1.5.0" } @@ -25,5 +24,5 @@ jetbrains-annotations = { group = "org.jetbrains", name = "annotations", version google-gson = { group = "com.google.code.gson", name = "gson", version = "2.13.2" } [plugins] -shadow-jar = { id = "com.gradleup.shadow", version = "9.2.2"} +shadow-jar = { id = "com.gradleup.shadow", version = "9.4.3"} plugin-publish = { id = "com.gradle.plugin-publish", version = "2.1.0" } diff --git a/plugin/build.gradle.kts b/plugin/build.gradle.kts index 14b8f3a..d09291e 100644 --- a/plugin/build.gradle.kts +++ b/plugin/build.gradle.kts @@ -4,21 +4,6 @@ import org.jetbrains.kotlin.gradle.dsl.JvmTarget import org.jetbrains.kotlin.gradle.dsl.KotlinVersion import org.jetbrains.kotlin.gradle.tasks.KotlinCompile -// Upgrade transitive dependencies in plugin classpath -buildscript { - repositories { - gradlePluginPortal() - } - dependencies { - constraints { - // The com.gradleup.shadow plugin depends on vulnerable library releases. - // We constrain these to newer, patched versions. - classpath(libs.apache.commons.io) - classpath(libs.apache.log4j.core) - } - } -} - plugins { kotlin("jvm") version(libs.versions.kotlin) alias(libs.plugins.plugin.publish)