Skip to content

Update all dependencies#53

Open
renovate[bot] wants to merge 1 commit intomainfrom
renovate/all
Open

Update all dependencies#53
renovate[bot] wants to merge 1 commit intomainfrom
renovate/all

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented Mar 24, 2026 •
edited
Loading

This PR contains the following updates:

Package Type Update Change Age Confidence
gradle (source) minor 9.4.1 → 9.5.0 age confidence
gradle/actions action major v5 → v6 age confidence
io.github.takahirom.roborazzi plugin minor 1.59.0 → 1.60.0 age confidence
io.github.takahirom.roborazzi:roborazzi-junit-rule dependencies minor 1.59.0 → 1.60.0 age confidence
io.github.takahirom.roborazzi:roborazzi-compose dependencies minor 1.59.0 → 1.60.0 age confidence
io.github.takahirom.roborazzi:roborazzi dependencies minor 1.59.0 → 1.60.0 age confidence
org.jetbrains.kotlin.plugin.compose (source) plugin patch 2.3.20 → 2.3.21 age confidence
com.google.devtools.ksp (source) plugin patch 2.3.6 → 2.3.7 age confidence
com.google.protobuf:protobuf-javalite (source) dependencies patch 4.34.0 → 4.34.1 age confidence
androidx.navigation:navigation-compose (source) dependencies patch 2.9.7 → 2.9.8 age confidence
androidx.navigation:navigation-runtime-ktx (source) dependencies patch 2.9.7 → 2.9.8 age confidence
androidx.compose:compose-bom dependencies minor 2026.03.00 → 2026.04.01 age confidence
com.google.protobuf:protoc (source) dependencies major 3.19.4 → 4.34.1 age confidence
org.jetbrains.kotlinx:kotlinx-serialization-json dependencies minor 1.10.0 → 1.11.0 age confidence
org.jetbrains.kotlin.plugin.serialization (source) plugin patch 2.3.20 → 2.3.21 age confidence
org.jetbrains.kotlin.android (source) plugin patch 2.3.20 → 2.3.21 age confidence
androidx.compose.foundation:foundation (source) dependencies minor 1.10.5 → 1.11.0 age confidence
com.google.protobuf plugin minor 0.9.6 → 0.10.0 age confidence
com.android.library (source) plugin minor 9.1.0 → 9.2.0 age confidence
com.android.application (source) plugin minor 9.1.0 → 9.2.0 age confidence

Release Notes

gradle/gradle (gradle)

v9.5.0

Compare Source

gradle/actions (gradle/actions)

v6.1.0

Compare Source

New: Basic Cache Provider

A new MIT-licensed Basic Caching provider is now available as an alternative to the proprietary Enhanced Caching provided by gradle-actions-caching. Choose Basic Caching by setting cache-provider: basic on setup-gradle or dependency-submission actions.

  • Built on @actions/cache -- fully open source
  • Caches ~/.gradle/caches and ~/.gradle/wrapper directories
  • Cache key derived from build files (*.gradle*, gradle-wrapper.properties, etc.)
  • Clean cache on build file changes (no restore keys, preventing stale entry accumulation)

Limitations vs Enhanced Caching: No cache cleanup, no deduplication of cached content, cached content is fixed unless build files change.

Revamped Licensing & Distribution Documentation

  • New DISTRIBUTION.md documents the licensing of each component (particularly Basic Caching vs Enhanced Caching)
  • Simplified licensing notices in README, docs, and runtime log output
  • Clear usage tiers: Enhanced Caching is free for public repos and in Free Preview for private repos

What's Changed

Full Changelog: gradle/actions@v6.0.1...v6.1.0

v6.0.1

Compare Source

[!IMPORTANT]
The release of gradle/actions@v6 contains important changes to the license terms. More details in this blog post.
TL;DR: By upgrading to v6, you accept the Terms of Use for the gradle-actions-caching component.

Summary

The license changes in v6 introduced a gradle-actions-caching license notice that is printed in logs and in each job summary.

With this release, the license notice will be muted if build-scan terms have been accepted, or if a Develocity access key is provided.

What's Changed
  • Bump actions used in docs by @​Goooler in #​792
  • Add typing information for use by typesafegithub by @​bigdaz in #​910
  • Mute license warning when terms are accepted by @​bigdaz in #​911
  • Mention explicit license acceptance in notice by @​bigdaz in #​912
  • Bump com.fasterxml.jackson.dataformat:jackson-dataformat-smile from 2.21.1 to 2.21.2 in /sources/test/init-scripts in the gradle group across 1 directory by @​dependabot[bot] in #​907

Full Changelog: gradle/actions@v6.0.0...v6.0.1

v6.0.0

Compare Source

[!IMPORTANT]
The release of gradle/actions@v6 contains important changes to the license terms. More details in this blog post.
TL;DR: By upgrading to v6, you accept the Terms of Use for the gradle-actions-caching component.

Summary
  • Caching functionality of 'gradle-actions' has been extracted into a separate gradle-actions-caching library, and is no longer open-source. See this blog post for more context.
  • Existing, rudimentary, configuration-cache support has been removed, pending a fully functional implementation in gradle-actions-caching.
  • Dependencies updated to address security vulnerabilities

[!IMPORTANT]

Licensing notice

The caching functionality in `gradle-actions` has been extracted into `gradle-actions-caching`, a proprietary commercial component that is not covered by the MIT License.
The bundled `gradle-actions-caching` component is licensed and governed by a separate license, available at https://gradle.com/legal/terms-of-use/.

The `gradle-actions-caching` component is used only when caching is enabled and is not loaded or used when caching is disabled.

Use of the `gradle-actions-caching` component is subject to a separate license, available at https://gradle.com/legal/terms-of-use/.
If you do not agree to these license terms, do not use the `gradle-actions-caching` component.

What's Changed

Full Changelog: gradle/actions@v5.0.2...v6.0.0

v6

Compare Source

v5.0.2

Compare Source

Summary

This release contains no functional changes. It updates dependencies and known Gradle wrapper checksums.

What's Changed

Full Changelog: gradle/actions@v5.0.1...v5.0.2

v5.0.1

Compare Source

What's Changed
  • Bump npm code dependency versions
  • Bump Gradle versions used in sample builds
  • Bump dependencies versions in Gradle sample builds
  • Bump GitHub actions used for build and test
  • Update known wrapper checksums to include Gradle 9.2+

Full Changelog: gradle/actions@v5.0.0...v5.0.1

takahirom/roborazzi (io.github.takahirom.roborazzi)

v1.60.0

Compare Source

Bugfix: Fix Roborazzi cache path sensitivity

When we use Roborazzi in a different path with the same repository, Roborazzi used to invalidate the cache. Though I think it is not critical because we frequently use test filters(--tests) when we run tests, which also invalidate the cache. But it's better to support the cache.
Thanks @​Link184 for the contribution!

What's Changed
New Contributors

Full Changelog: takahirom/roborazzi@1.59.0...1.60.0

JetBrains/kotlin (org.jetbrains.kotlin.plugin.compose)

v2.3.21

Backend. Wasm
  • KT-84610 [Wasm] Failed to compile klibs in IC mode
Compiler
  • KT-84566 Prevent launching Default dispatcher threads from IJ SDK in kotlin compiler
  • KT-85358 Native: roll back the workaround for KT-84678 once MapLibre has been properly fixed
  • KT-85626 @JvmRecord in commonMain breaks compileCommonMainKotlinMetadata with "Cannot access 'java.lang.Record'"
  • KT-85405 Postpone/Revert DontIgnoreUpperBoundViolatedOnImplicitArguments
  • KT-84678 K/N: Undefined symbol from SPM-added ObjC frameworks when linking iOS target
  • KT-85021 False positive SUBCLASS_CANT_CALL_COMPANION_PROTECTED_NON_STATIC error in multi-module project
JavaScript
  • KT-82395 Support top-level declarations from compiler plugins in JS incremental compilation
  • KT-84475 K/JS: false-positive exportability warnings in multi-module project
  • KT-84633 Kotlin/JS: "Serializer for class not found" error when IR output granularity is whole-program
  • KT-85047 Kotlin/JS: @JsStatic on suspend fun of class companion generates incorrect d.ts
  • KT-84517 K/JS: bad mappings data in outputted Kotlin stdlib source map
Libraries
  • KT-71848 Kotlinx.metadata: Add CompilerPluginData into Km API
Native. C and ObjC Import
  • KT-85399 Kotlin/Native: TypeCastException when casting ObjC Protocol MetaClass with genericSafeCasts enabled
  • KT-85508 K/N: TypeCastException when using nw_parameters_create_secure_tcp block parameter on 2.3.20
Tools. Gradle
  • KT-84729 Update Gradle plugin-publish version to enable configuration cache badge on Gradle plugins portal
Tools. Gradle. Compiler plugins
  • KT-85257 AGP/Compose: MergeMappingFileTask clears R8 artifacts due to @OutputDirectory annotation on AGP 9.1+
Tools. Scripts
  • KT-85105 Scripts: JVM backend internal error (IR lowering) when scratch file contains anonymous object
  • KT-85103 Exception while generating code when explain destructuring decls
  • KT-84842 scriptCompilationClasspathFromContext behavior changed from 2.3.10 to 2.3.20
  • KT-85029 Kotlin Scripting: ScriptDiagnostic reports "at null" instead of error location
Tools. Statistics (FUS)
  • KT-85628 KGP: composite build FUS metrics fail on access of 'configurationTimeMetrics'
google/ksp (com.google.devtools.ksp)

v2.3.7

Compare Source

What's Changed

  • Bumped Kotlin target language version to 2.3.20 (#​2821)
  • Fixed an issue where the plugin adds a maven repo to the build and corrected the compiler plugin artifact (#​2856)
  • Fixed a crash with IllegalStateException when source contains a class-level destructuring declaration (#​2861)
  • Fixed support for Gradle Isolated Projects (#​2844)
  • Fixed Windows build failure when the path is long (#​2815)
  • Fixed issue where KSP does not call SymbolProcessor in some Gradle setups (#​2511)
  • Fixed a crash in PsiResolutionStrategy for annotations with nullable fully qualified names (#​2864)
  • Improved performance by lazily computing fully qualified Java annotation names (#​2860)

Contributors

  • Thanks to everyone who reported bugs and participated in discussions!

Full Changelog: google/ksp@2.3.6...2.3.7

protocolbuffers/protobuf (com.google.protobuf:protoc)

v4.31.1

v4.31.0

v4.30.2

v4.30.1

v3.25.8

v3.25.7

v3.25.6

v3.25.5

v3.25.4

v3.25.3

v3.25.2

v3.25.1

v3.25.0

v3.24.4

v3.24.3

v3.24.2

v3.24.1

v3.24.0

v3.23.4

v3.23.3

v3.23.2

v3.23.1

v3.23.0

v3.22.5

v3.22.4

v3.22.3

v3.22.2

v3.22.1

v3.22.0

v3.21.12

v3.21.11

v3.21.10

v3.21.9

v3.21.8

v3.21.7

v3.21.6

v3.21.5

v3.21.4

v3.21.3

v3.21.2

v3.21.1

v3.21.0

v3.20.3: Protocol Buffers v3.20.3

Java
  • Refactoring java full runtime to reuse sub-message builders and prepare to
    migrate parsing logic from parse constructor to builder.
  • Move proto wireformat parsing functionality from the private "parsing
    constructor" to the Builder class.
  • Change the Lite runtime to prefer merging from the wireformat into mutable
    messages rather than building up a new immutable object before merging. This
    way results in fewer allocations and copy operations.
  • Make message-type extensions merge from wire-format instead of building up
    instances and merging afterwards. This has much better performance.
  • Fix TextFormat parser to build up recurring (but supposedly not repeated)
    sub-messages directly from text rather than building a new sub-message and
    merging the fully formed message into the existing field.
  • This release addresses a Security Advisory for Java users

v3.20.2: Protocol Buffers v3.20.2

C++

v3.20.1: Protocol Buffers v3.20.1

PHP
  • Fix building packaged PHP extension (#​9727)
  • Fixed composer.json to only advertise compatibility with PHP 7.0+. (#​9819)
Ruby
  • Disable the aarch64 build on macOS until it can be fixed. (#​9816)
Other
  • Fix versioning issues in 3.20.0

v3.20.0: Protocol Buffers v3.20.0

2022-03-25 version 3.20.0 (C++/Java/Python/PHP/Objective-C/C#/Ruby/JavaScript)

Ruby
  • Dropped Ruby 2.3 and 2.4 support for CI and releases. (#​9311)
  • Added Ruby 3.1 support for CI and releases (#​9566).
  • Message.decode/encode: Add recursion_limit option (#​9218/#​9486)
  • Allocate with xrealloc()/xfree() so message allocation is visible to the
    Ruby GC. In certain tests this leads to much lower memory usage due to more
    frequent GC runs (#​9586).
  • Fix conversion of singleton classes in Ruby (#​9342)
  • Suppress warning for intentional circular require (#​9556)
  • JSON will now output shorter strings for double and float fields when possible
    without losing precision.
  • Encoding and decoding of binary format will now work properly on big-endian
    systems.
  • UTF-8 verification was fixed to properly reject surrogate code points.
  • Unknown enums for proto2 protos now properly implement proto2's behavior of
    putting such values in unknown fields.
Java
  • Revert "Standardize on Array copyOf" (#​9400)
  • Resolve more java field accessor name conflicts (#​8198)
  • Don't support map fields in DynamicMessage.Builder.{getFieldBuilder,getRepeatedFieldBuilder}
  • Fix parseFrom to only throw InvalidProtocolBufferException
  • InvalidProtocolBufferException now allows arbitrary wrapped Exception types.
  • Fix bug in FieldSet.Builder.mergeFrom
  • Flush CodedOutputStream also flushes underlying OutputStream
  • When oneof case is the same and the field type is Message, merge the
    subfield. (previously it was replaced.)’
  • Add @​CheckReturnValue to some protobuf types
  • Report original exceptions when parsing JSON
  • Add more info to @​deprecated javadoc for set/get/has methods
  • Fix initialization bug in doc comment line numbers
  • Fix comments for message set wire format.
Kotlin
  • Add test scope to kotlin-test for protobuf-kotlin-lite (#​9518)
  • Add orNull extensions for optional message fields.
  • Add orNull extensions to all proto3 message fields.
Python
  • Dropped support for Python < 3.7 (#​9480)
  • Protoc is now able to generate python stubs (.pyi) with --pyi_out
  • Pin multibuild scripts to get manylinux1 wheels back (#​9216)
  • Fix type annotations of some Duration and Timestamp methods.
  • Repeated field containers are now generic in field types and could be used
    in type annotations.
    *[Breaking change] Protobuf python generated codes are simplified. Descriptors and message
    classes' definitions are now dynamic created in internal/builder.py.
    Insertion Points for messages classes are discarded.
  • has_presence is added for FieldDescriptor in python
  • Loosen indexing type requirements to allow valid index() implementations
    rather than only PyLongObjects.
  • Fix the deepcopy bug caused by not copying message_listener.
  • Added python JSON parse recursion limit (default 100)
  • Path info is added for python JSON parse errors
  • Pure python repeated scalar fields will not able to pickle. Convert to list
    first.
  • Timestamp.ToDatetime() now accepts an optional tzinfo parameter. If
    specified, the function returns a timezone-aware datetime in the given time
    zone. If omitted or None, the function returns a timezone-naive UTC datetime
    (as previously).
  • Adds client_streaming and server_streaming fields to MethodDescriptor.
  • Add "ensure_ascii" parameter to json_format.MessageToJson. This allows smaller
    JSON serializations with UTF-8 or other non-ASCII encodings.
  • Added experimental support for directly assigning numpy scalars and array.
  • Improve the calculation of public_dependencies in DescriptorPool.
  • [Breaking Change] Disallow setting fields to numpy singleton arrays or repeated fields to numpy
    multi-dimensional arrays. Numpy arrays should be indexed or flattened explicitly before assignment.
Compiler
  • Migrate IsDefault(const std::string*) and UnsafeSetDefault(const std::string*)
  • Implement strong qualified tags for TaggedPtr
  • Rework allocations to power-of-two byte sizes.
  • Migrate IsDefault(const std::string*) and UnsafeSetDefault(const std::string*)
  • Implement strong qualified tags for TaggedPtr
  • Make TaggedPtr Set...() calls explicitly spell out the content type.
  • Check for parsing error before verifying UTF8.
  • Enforce a maximum message nesting limit of 32 in the descriptor builder to
    guard against stack overflows
  • Fixed bugs in operators for RepeatedPtrIterator
  • Assert a maximum map alignment for allocated values
  • Fix proto1 group extension protodb parsing error
  • Do not log/report the same descriptor symbol multiple times if it contains
    more than one invalid character.
  • Add UnknownFieldSet::SerializeToString and SerializeToCodedStream.
  • Remove explicit default pointers and deprecated API from protocol compiler
Arenas
  • Change Repeated*Field to reuse memory when using arenas.
  • Implements pbarenaz for profiling proto arenas
  • Introduce CreateString() and CreateArenaString() for cleaner semantics
  • Fix unreferenced parameter for MSVC builds
  • Add UnsafeSetAllocated to be used for one-of string fields.
  • Make Arena::AllocateAligned() a public function.
  • Determine if ArenaDtor related code generation is necessary in one place.
  • Implement on demand register ArenaDtor for InlinedStringField
C++
  • Enable testing via CTest (#​8737)
  • Add option to use external GTest in CMake (#​8736)
  • CMake: Set correct sonames for libprotobuf-lite.so and libprotoc.so (#​8635) (#​9529)
  • Add cmake option protobuf_INSTALL to not install files (#​7123)
  • CMake: Allow custom plugin options e.g. to generate mocks (#​9105)
  • CMake: Use linker version scripts (#​9545)
  • Manually *struct Cord fields to work better with arenas.
  • Manually destruct map fields.
  • Generate narrower code
  • Fix #​9378 by removing
    shadowed cached_size field
  • Remove GetPointer() and explicit nullptr defaults.
  • Add proto_h flag for speeding up large builds
  • Add missing overload for reference wrapped fields.
  • Add MergedDescriptorDatabase::FindAllFileNames()
  • RepeatedField now defines an iterator type instead of using a pointer.
  • Remove obsolete macros GOOGLE_PROTOBUF_HAS_ONEOF and GOOGLE_PROTOBUF_HAS_ARENAS.
PHP
  • Fix: add missing reserved classnames (#​9458)
  • PHP 8.1 compatibility (#​9370)
C#
  • Fix trim warnings (#​9182)
  • Fixes NullReferenceException when accessing FieldDescriptor.IsPacked (#​9430)
  • Add ToProto() method to all descriptor classes (#​9426)
  • Add an option to preserve proto names in JsonFormatter (#​6307)
Objective-C
  • Add prefix_to_proto_package_mappings_path option. (#​9498)
  • Rename proto_package_to_prefix_mappings_path to package_to_prefix_mappings_path. (#​9552)
  • Add a generation option to control use of forward declarations in headers. (#​9568)

v3.19.6: Protocol Buffers v3.19.6

Java
  • Refactoring java full runtime to reuse sub-message builders and prepare to
    migrate parsing logic from parse constructor to builder.
  • Move proto wireformat parsing functionality from the private "parsing
    constructor" to the Builder class.
  • Change the Lite runtime to prefer merging from the wireformat into mutable
    messages rather than building up a new immutable object before merging. This
    way results in fewer allocations and copy operations.
  • Make message-type extensions merge from wire-format instead of building up
    instances and merging afterwards. This has much better performance.
  • Fix TextFormat parser to build up recurring (but supposedly not repeated)
    sub-messages directly from text rather than building a new sub-message and
    merging the fully formed message into the existing field.
  • This release addresses a Security Advisory for Java users

v3.19.5: Protocol Buffers v3.19.5

C++
Kotlin/kotlinx.serialization (org.jetbrains.kotlinx:kotlinx-serialization-json)

v1.11.0

==================

This release is based on Kotlin 2.3.20 and provides new Json exceptions API and some bugfixes and improvements.

Expose Json exceptions structure

To make working with exceptions easier and providing proper error codes in e.g., REST APIs,
classes JsonException, JsonDecodingException, and JsonEncodingException are now public.
They have relevant public properties, such as shortMessage, path, offset, and others.
This API is currently experimental, and we're going to improve it further in the subsequent releases.
See the linked issues for the details: #​1930, #​1877.

Ability to hide user input from exception messages for security/privacy reasons.

Historically, exception messages in kotlinx.serialization often included the input Json itself for debuggability reason.
Such behavior may pose additional challenges for logging, analytics, and other systems, since
a system is not always allowed to store user data due to privacy/security reasons, which imposes additional sanitation logic.
To address this issue, a new property exceptionsWithDebugInfo is added to JsonConfiguration.
Disable it to hide user input from exception messages.
IMPORTANT: This behavior will be enabled by default when this property becomes stable.
See #​2590 for more details.

Bugfixes and improvements

  • CBOR: Relax value range check when decoding numbers (#​3167)
  • Use a specialized writeDecimalLong method for IO stream integrations in Json (#​3152)

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot requested review from cka-dev and romanofranz as code owners March 24, 2026 01:03
@renovate renovate Bot force-pushed the renovate/all branch 2 times, most recently from 1337fab to 547e905 Compare March 26, 2026 17:58
@renovate renovate Bot changed the title fix(deps): update all dependencies Update all dependencies Apr 8, 2026
@renovate renovate Bot force-pushed the renovate/all branch 2 times, most recently from 32a500f to 00e890f Compare April 13, 2026 14:15
@renovate renovate Bot force-pushed the renovate/all branch 5 times, most recently from 442165d to bb9b5cc Compare April 23, 2026 09:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cka-dev cka-dev Awaiting requested review from cka-dev cka-dev is a code owner

@romanofranz romanofranz Awaiting requested review from romanofranz romanofranz is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants