fix(deps): update all dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Age	Confidence
actions/setup-java	action	minor	v6.0.1 → v6.1.0
gradle (source)		minor	9.7.1 → 9.8.1
ubuntu	github-runner	major	24.04 → 26.04
com.mikepenz.aboutlibraries.plugin.android	plugin	minor	15.2.0 → 15.3.0
com.google.guava:guava	dependencies	patch	33.7.1-android → 33.7.2-android
net.bytebuddy:byte-buddy (source)	dependencies	patch	1.18.14-jdk5 → 1.18.15-jdk5
com.gradle.develocity	plugin	minor	4.5.1 → 4.6.0
androidx.core:core-ktx (source)	dependencies	patch	1.19.0 → 1.19.1
androidx.annotation:annotation (source)	dependencies	minor	1.10.0 → 1.11.0
org.lsposed.hiddenapibypass:hiddenapibypass	dependencies	minor	6.1 → 6.2
com.google.protobuf:protoc (source)	dependencies	patch	4.36.1 → 4.36.2
com.google.protobuf:protobuf-java (source)	dependencies	patch	4.36.1 → 4.36.2
org.jetbrains.kotlin.plugin.serialization (source)	plugin	patch	2.4.20 → 2.4.21
org.jetbrains.kotlin.jvm	plugin	patch	2.4.20 → 2.4.21
org.jetbrains.kotlin:kotlin-gradle-plugin (source)	dependencies	patch	2.4.20 → 2.4.21
com.android.library (source)	plugin	patch	9.4.0 → 9.4.1

---

Release Notes

actions/setup-java

v6.1.0

Compare Source

What's Changed

• Preserve compound Liberica build versions from .sdkmanrc by @​brunoborges with @​Copilot in #​1268
• Support Temurin on Linux RISC-V by @​yawkat in #​1269
• Stop GPG agent before removing signature-verification home by @​brunoborges with @​Copilot in #​1273
• Prefer Zulu 4-segment hotfix builds when resolving version ranges by @​brunoborges in #​1278
• Support Temurin JEP 322 patch versions like 26.0.2.1+1 by @​brunoborges in #​1279
• chore(deps): bump undici from 6.28.0 to 6.29.0 by @​dependabot[bot] in #​1274
• chore(deps): bump the monthly-npm-updates group with 13 updates by @​dependabot[bot] in #​1276
• feat: support Maven server credential origins by @​YunaBraska in #​1282
• Support Maven plugin repositories in generated settings.xml by @​brunoborges in #​1286

New Contributors

• @​yawkat made their first contribution in #​1269
• @​YunaBraska made their first contribution in #​1282

Full Changelog: actions/setup-java@v6.0.1...v6.1.0

gradle/gradle (gradle)

v9.8.1: 9.8.1

Compare Source

This is a patch release for Gradle 9.8.0. We recommend using 9.8.1 instead of 9.8.0.

This release addresses three high rated vulnerabilities:

• Unauthenticated worker-to-daemon channel deserializes untrusted Java objects
• Deserialization of untrusted Java objects before authentication in the client - daemon communication
• Failure to disable repositories failing to establish an SSL connection can expose builds to malicious artifacts

The following issues were resolved:

• [Gradle 9.8.0 complains again about invalid Toolchains on Debian / Ubuntu packaged systems]- (#​39358)
• Gradle 9.8.0 removes root java.util.logging handlers installed by a custom LogManager (breaks Quarkus test log capture)
• Dependency resolution regression

Read the Release Notes

We would like to thank the following community members for their contributions to this release of Gradle:
Aman Gautam,
Björn Kautler,
Eng Zer Jun,
Hashim Khan,
Julian Krannich,
KBS,
Labh R Jethe,
Mark Dodgson,
Maxim,
monkey,
nataphon-ktsystems,
Paul King,
Qiu Tian,
rg_sandesh,
Roberto Perez Alcolea,
Sean,
Zongle Wang.

Upgrade instructions

Switch your build to use Gradle 9.8.1 by updating your wrapper:

./gradlew :wrapper --gradle-version=9.8.1 && ./gradlew :wrapper

See the Gradle 9.x upgrade guide to learn about deprecations, breaking changes and other considerations when upgrading.

For Java, Groovy, Kotlin and Android compatibility, see the full compatibility notes.

Reporting problems

If you find a problem with this release, please file a bug on GitHub Issues adhering to our issue guidelines.
If you're not sure you're encountering a bug, please use the forum.

We hope you will build happiness with Gradle, and we look forward to your feedback via Twitter or on GitHub.

v9.8.0: 9.8.0

Compare Source

The Gradle team is excited to announce Gradle 9.8.0.

Here are the highlights of this release:

• Java 27 support
• Maven mirror settings reuse
• Linked problem locations in build output

Read the Release Notes

We would like to thank the following community members for their contributions to this release of Gradle:
Aman Gautam,
Björn Kautler,
Eng Zer Jun,
Hashim Khan,
Julian Krannich,
KBS,
Labh R Jethe,
Mark Dodgson,
Maxim,
monkey,
nataphon-ktsystems,
Paul King,
Qiu Tian,
rg_sandesh,
Roberto Perez Alcolea,
Sean,
Zongle Wang.

Upgrade instructions

Switch your build to use Gradle 9.8.0 by updating your wrapper:

./gradlew :wrapper --gradle-version=9.8.0 && ./gradlew :wrapper

See the Gradle 9.x upgrade guide to learn about deprecations, breaking changes and other considerations when upgrading.

For Java, Groovy, Kotlin and Android compatibility, see the full compatibility notes.

Reporting problems

If you find a problem with this release, please file a bug on GitHub Issues adhering to our issue guidelines.
If you're not sure you're encountering a bug, please use the forum.

We hope you will build happiness with Gradle, and we look forward to your feedback via Twitter or on GitHub.

raphw/byte-buddy (net.bytebuddy:byte-buddy)

v1.18.14

• Avoid exposure of the agent argument on the command line of the process that is spawned for an external attachment.
• Avoid the resolution of symbolic links when the Gradle plugin deletes a folder recursively.
• Limit the nesting depth that is accepted when parsing a generic type signature to avoid an exhaustion of the stack for a malformed class file.
• Sign all deployed files using sigstore, in addition to the existing GPG signature.
• Validate entry names when the Android plugin retains a file to avoid the propagation of path traversals.

JetBrains/kotlin (org.jetbrains.kotlin.plugin.serialization)

v2.4.21

Backend. Wasm

• KT-89267 K/Wasm: calling a (T) -> R lambda with an argument that isn't a T traps instead of throwing ClassCastException

JVM. Reflection

• KT-89280 NoSuchElementException in argumentsMakeSenseOnlyForMutableContainer for Java non-static inner class of generic outer class
• KT-80710 Reflection: change KCallable representation to avoid dependency on K1

JavaScript

• KT-89449 Kotlin/JS: Member names no longer minified in production
• KT-89363 KJS. Regular class with companion can't extend external class

Tools. Compiler plugins. Serialization

• KT-89275 Kotlin/Wasm: Invalid Wasm is emitted for a @Serializable generic class with a class upper bound

Tools. Gradle. Native

• KT-89285 SwiftPM import results in flooded log
• KT-86251 K/N: Flaky linkDebugTestLinuxX64 failure with "truncated or malformed archive" on libstdlib-cache.a

Tools. Scripts

• KT-89247 Kotlin Script: NoClassDefFoundError on 2nd execution with transitive dependency from imported script
• KT-89220 JSR-223: generic Java bindings break all subsequent eval() calls
• KT-88458 Audit closeable resource usage
• KT-88453 VirtualFileScriptSource.text leaks an unclosed file stream — script source file handle held until GC, blocks file deletion on Windows

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.