Update dependency com.gradleup.shadow:shadow-gradle-plugin to v9.6.1

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
com.gradleup.shadow:shadow-gradle-plugin	9.1.0 → 9.6.1

---

Release Notes

GradleUp/shadow (com.gradleup.shadow:shadow-gradle-plugin)

v9.6.1

Compare Source

Changed

• Use GradleException for expected build failures. (#​2113)

Fixed

• Preserve repeated lines in R8 rule files when using minimize { r8 { ... } }. (#​2115)

v9.6.0

Compare Source

Added

• Extract R8 rules from dependency JARs when using minimize { r8 { ... } }. (#​2089)

Changed

• Rename ShadowDslMarker to ShadowDsl. (#​2091)
• POTENTIALLY BREAKING: Apply @ShadowDsl to ShadowJar, ResourceTransformer, DependencyFilter, and Relocator. (#​2090)
  This restricts nested DSL configuration blocks from implicitly calling outer receiver APIs in Kotlin script files.

Fixed

• Validate ZIP entry names to prevent Zip Slip path traversal.
• Avoid resolving unused R8 dependency. (#​2101)

v9.5.1

Compare Source

Fixed

• Fix eager calls for toolchainSpec in Kotlin DSL. (#​2087)

v9.5.0

Compare Source

[!NOTE]
With the introduction of DuplicatesStrategy checking for transformers, you may see warnings like:

'META-INF/...kotlin_module' is matched by com.github.jengelman.gradle.plugins.shadow.transformers.KotlinModuleMetadataTransformer but its DuplicatesStrategy is EXCLUDE — duplicates may be silently dropped before the transformer processes them.

If you do not need Kotlin module metadata remapping, you can disable it:

tasks.shadowJar {
  @Suppress("DEPRECATION") // This flag will be disabled and removed in the next major version of Shadow.
  enableKotlinModuleRemapping = false
}

Added

• Check DuplicatesStrategy for merging transformers. (#​2026)
  This will log warnings when an incompatible DuplicatesStrategy (e.g., EXCLUDE) is applied in Gradle configuration for built-in ResourceTransformers.
• Add KotlinModuleMetadataTransformer. (#​2073)
• Add R8 as an opt-in minimize { r8 { ... } } tool for shrinking the final shadowed JAR. (#​2077)

Changed

• Bump min Gradle requirement to 9.2.0. (#​2057)
• Remove afterEvaluate when adding variants. (#​2056)

Deprecated

• Deprecate enableKotlinModuleRemapping for ShadowJar. (#​2073)
  Apply KotlinModuleMetadataTransformer explicitly to support relocating inside Kotlin module metadata files.
• Deprecate everything under ShadowCopyAction. (#​2083)

Fixed

• Fix the conflicts when using afterEvaluate with other plugins. (#​2055)

v9.4.3

Compare Source

Changed

• Update dependencies for resolving CVEs. (#​2069)

v9.4.2

Compare Source

Changed

• Update jdependency to support Java 27. (#​2033)

v9.4.1

Compare Source

Changed

• Update Kotlin to 2.3.20. (#​1978)

v9.4.0

Compare Source

Added

• Support Isolated Projects. (#​1139)

Changed

• Allow opting out of adding shadowJar into assemble lifecycle. (#​1939)

  shadow {
    // Disable making `assemble` task depend on `shadowJar`. This is enabled by default.
    addShadowJarToAssembleLifecycle = false
  }

• Stop catching ZipException when writing entries. (#​1970)

Fixed

• Fix interaction with Gradle artifact transforms. (#​1345)
• Fix skipStringConstants per-relocator behavior in mapName. (#​1968)
• Fix failing for non-existent class directories. (#​1976)

v9.3.2

Compare Source

Changed

• Stop moving gradleApi dependency from api to compileOnly for Gradle 9.4+. (#​1919)
• Log warnings for duplicates in the final JAR. (#​1931)

Fixed

• Fix relocation patterns not included in task fingerprint. (#​1933)

v9.3.1

Compare Source

Fixed

• Use ASM from jdependency embedded. (#​1898)
  This fixes potential classpath conflicts when using Shadow with other plugins that also use ASM.

v9.3.0

Compare Source

Added

• Add PatternFilterableResourceTransformer to simplify pattern based ResourceTransformers. (#​1849)
• Expose patternSet of ServiceFileTransformer as public. (#​1849)
• Expose patternSet of ApacheLicenseResourceTransformer as public. (#​1850)
• Expose patternSet of ApacheNoticeResourceTransformer as public. (#​1850)
• Expose patternSet of PreserveFirstFoundResourceTransformer as public. (#​1855)
• Support overriding output path of ApacheNoticeResourceTransformer. (#​1851)
• Add new merge strategy Fail to PropertiesFileTransformer. (#​1856)
• Add FindResourceInClasspath task to help with debugging issues with merged duplicate resources. (#​1860)
• Add MergeLicenseResourceTransformer. (#​1858)
• Add DeduplicatingResourceTransformer to deduplicate on path and content. (#​1859)
• Support disabling Kotlin module metadata remapping. (#​1875)

  tasks.shadowJar {
    // Disable remapping of Kotlin module metadata (`.kotlin_module`) files. This is enabled by default.
    enableKotlinModuleRemapping = false
  }

Changed

• Change the group of startShadowScripts from application to other. (#​1797)
• Update ASM and jdependency to support Java 26. (#​1799)
• Bump min Gradle requirement to 9.0.0. (#​1801)
• Make the output of PropertiesFileTransformer reproducible. (#​1861)

Deprecated

• Deprecate PreserveFirstFoundResourceTransformer.resources. (#​1855)
• Deprecate ShadowCopyAction. (#​1876)

Fixed

• Fix Develocity integration when Isolated Projects enabled. (#​1836)

v9.2.2

Compare Source

Fixed

• Fix the regression of registering ShadowJar tasks without ShadowPlugin applied. (#​1787)

v9.2.1

Compare Source

Added

• Support relocating Groovy extensions in Module descriptors. (#​1705)
• Add extensions for Iterable<Relocator>. (#​1710)
• Support relocating list of types in RelocatorRemapper. (#​1714)
• Add mainClass property into ShadowJar. (#​1722)

  tasks.shadowJar {
    // This property will be used as a fallback if there is no explicit `Main-Class` attribute set.
    mainClass = "my.Main"
  }

• Honor executableDir and applicationName in application extension. (#​1740)
  This is useful when you want to customize the output directory of the start scripts and the application distribution.
• Provide more task accessors in ShadowApplicationPlugin.Companion. (#​1771)
• Support relocating Kotlin module files. (#​1539)
  The current implementation relocates all properties in KotlinModuleMetadata but KmModule.optionalAnnotationClasses
  due to very limited usage of it. See more discussion here.
• Allow overriding BUNDLING_ATTRIBUTE in GMM. (#​1773)
  The org.gradle.dependency.bundling in shadowed JAR's Gradle Module Metadata is set to shadowed by default.
  You can override it for now by:

  shadow {
    bundlingAttribute = Bundling.EMBEDDED
  }

Changed

• Merge Groovy Module descriptors into the modern META-INF path. (#​1706)
  The Groovy Module descriptors (org.codehaus.groovy.runtime.ExtensionModule files) defined under META-INF/services/
  and META-INF/groovy will be merged into META-INF/groovy/org.codehaus.groovy.runtime.ExtensionModule.
• Move injecting Class-Path manifest attr logic from doFirst into copy. (#​1720)
• Move injecting Main-Class manifest attr logic from doFirst into copy. (#​1724)
• Use default JavaExec error message when main class is not set. (#​1725)
• Update RelocatorRemapper class pattern to cover more Java method descriptors. (#​1731)
• Stop using start script templates bundled in Shadow. (#​1738)
• Bump min Java requirement to 17. (#​1744)
• Require most optional properties non-null. (#​1745)
• Make assemble depend on shadowJar even if it is added later. (#​1766)

Deprecated

• Deprecate InheritManifest and inheritFrom. (#​1722)

  tasks.shadowJar {
    // Before (deprecated):
    manifest.inheritFrom(tasks.jar.get().manifest)
  
    // After (recommended):
    manifest.from(tasks.jar.get().manifest)
  
    // Note: You don't need to inherit the manifest from `jar` task as it's done by default for the `shadowJar` task.
    // But if you want to inherit the manifest for your custom `ShadowJar` task, you still need to do it explicitly.
  }

Fixed

• Fix excluding dependencies whose versions contain +. (#​1597)

v9.2.0

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}