Upgrade shadow to 9.4.3 and drop redundant vulnerability constraints - #222
Merged
Conversation
Bump com.gradleup.shadow 9.2.2 -> 9.4.3, the latest release. It builds and tests cleanly on the existing Gradle 8.14.4, so no Gradle bump is required and Gradle 5 runtime compatibility is unaffected. Shadow 9.4.3 now ships patched transitive dependencies (commons-io 2.22.0, log4j-core 2.26.0), so the buildscript constraints that forced newer versions are redundant. Remove the buildscript block and the apache-log4j-core catalog entry (the only consumer of the constraint). apache-commons-io is retained as it is still used by plugin-test. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
bigdaz
enabled auto-merge (squash)
July 4, 2026 23:36
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
com.gradleup.shadow9.2.2 → 9.4.3 (latest release).buildscript { … constraints { … } }block inplugin/build.gradle.ktsthat forced patchedcommons-io/log4j-coreversions.apache-log4j-coreversion-catalog entry (its only consumer was that constraint).apache-commons-iois kept — it's still used byplugin-test.Why
Shadow 9.4.3 now ships patched transitive dependencies natively (
commons-io:2.22.0,log4j-core:2.26.0), which are newer than the versions the constraints pinned. The constraints had become no-ops, so they're removed along with the now-unused catalog entry.Gradle version
Left at 8.14.4. The latest shadow does not require Gradle 9 — 9.4.3 builds and tests cleanly on 8.14.4 — so no Gradle bump is needed and the plugin's Gradle 5 runtime compatibility is unaffected.
Note: this does not remove the
org.gradle.api.plugins.Conventiondeprecation warning — that originates from the Kotlin Gradle plugin (1.8.10), not shadow.Verification
:plugin:test✅:plugin-test:test(integration suite) ✅:plugin:shadowJar✅ — buildscript classpath still resolvescommons-io:2.22.0/log4j-core:2.26.0🤖 Generated with Claude Code