Skip to content

chore(deps): bump the production-dependencies group across 1 directory with 5 updates#21

Closed
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/gradle/production-dependencies-2e54e5685d
Closed

chore(deps): bump the production-dependencies group across 1 directory with 5 updates#21
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/gradle/production-dependencies-2e54e5685d

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 5 updates in the / directory:

Package From To
com.vanniktech.maven.publish 0.30.0 0.37.0
org.jetbrains:annotations 26.0.2-1 26.1.0
com.squareup.okhttp3:okhttp 5.3.2 5.4.0
com.google.code.gson:gson 2.13.2 2.14.0
org.seleniumhq.selenium:selenium-java 4.44.0 4.45.0

Updates com.vanniktech.maven.publish from 0.30.0 to 0.37.0

Release notes

Sourced from com.vanniktech.maven.publish's releases.

0.37.0

  • When publishing to Maven Central, redundant checksum files are now excluded by default: checksums of .asc signature files (gradle/gradle#20232) and the sha256/sha512 checksums, which are never read by Gradle or Maven Central. The published checksums can be configured through checksums(...) in the DSL or the mavenCentralChecksums Gradle property (default md5,sha1). Signature checksum exclusion can be controlled through excludeSignatureChecksums() or the mavenCentralExcludeSignatureChecksums Gradle property.
  • Maven Central deployment id is being logged after upload.

Minimum supported versions

  • JDK 17
  • Gradle 9.0.0
  • Android Gradle Plugin 8.13.0
  • Kotlin Gradle Plugin 2.2.0

Compatibility tested up to

  • JDK 26
  • Gradle 9.6.0
  • Gradle 9.7.0-milestone-1
  • Android Gradle Plugin 9.2.1
  • Android Gradle Plugin 9.3.0-rc01
  • Android Gradle Plugin 9.4.0-alpha01
  • Kotlin Gradle Plugin 2.4.0

0.37.0-rc1

  • When publishing to Maven Central, redundant checksum files are now excluded by default: checksums of .asc signature files (gradle/gradle#20232) and the sha256/sha512 checksums, which are never read by Gradle or Maven Central. The published checksums can be configured through checksums(...) in the DSL or the mavenCentralChecksums Gradle property (default md5,sha1). Signature checksum exclusion can be controlled through excludeSignatureChecksums() or the mavenCentralExcludeSignatureChecksums Gradle property.
  • Maven Central deployment id is being logged after upload.

Minimum supported versions

  • JDK 17
  • Gradle 9.0.0
  • Android Gradle Plugin 8.13.0
  • Kotlin Gradle Plugin 2.2.0

Compatibility tested up to

  • JDK 26
  • Gradle 9.6.0
  • Gradle 9.7.0-milestone-1
  • Android Gradle Plugin 9.2.1
  • Android Gradle Plugin 9.3.0-rc01
  • Android Gradle Plugin 9.4.0-alpha01
  • Kotlin Gradle Plugin 2.4.0

0.36.0

BREAKING

... (truncated)

Changelog

Sourced from com.vanniktech.maven.publish's changelog.

0.37.0 (2026-06-21)

  • When publishing to Maven Central, redundant checksum files are now excluded by default: checksums of .asc signature files (gradle/gradle#20232) and the sha256/sha512 checksums, which are never read by Gradle or Maven Central. The published checksums can be configured through checksums(...) in the DSL or the mavenCentralChecksums Gradle property (default md5,sha1). Signature checksum exclusion can be controlled through excludeSignatureChecksums() or the mavenCentralExcludeSignatureChecksums Gradle property.
  • Maven Central deployment id is being logged after upload.

Minimum supported versions

  • JDK 17
  • Gradle 9.0.0
  • Android Gradle Plugin 8.13.0
  • Kotlin Gradle Plugin 2.2.0

Compatibility tested up to

  • JDK 26
  • Gradle 9.6.0
  • Gradle 9.7.0-milestone-1
  • Android Gradle Plugin 9.2.1
  • Android Gradle Plugin 9.3.0-rc01
  • Android Gradle Plugin 9.4.0-alpha01
  • Kotlin Gradle Plugin 2.4.0

0.36.0 (2026-01-13)

BREAKING

  • Updated minimum supported JDK, Gradle, Android Gradle Plugin and Kotlin versions.
  • Removed support for Dokka v1, it's now required to use Dokka in v2 mode.
  • Mark DirectorySignatureType internal.

Behavior changes

  • validateDeployment now has the DeploymentValidation enum as type instead of being a boolean. The default is now to just wait for the VALIDATED state. The previous behavior can be achieved by setting it to PUBLISHED. NONE can be used for disabling the validation completely.
  • When calling configure(...) manually to configure what to publish and not passing javadocJar explicity, the plugin now defaults to publishing an empty javadoc jar.

Features

  • Android projects now support using Dokka for javadoc creation, this will happen automatically when using the default options and the Dokka plugin is applied to the project.
  • Added consistent JavadocJar and SourcesJar options to configureBasedOnAppliedPlugins and to all applicable project types that can be passed to configure. The previous Boolean based versions have been deprecated.
  • When enabling Maven Central publishing through the DSL, the mavenCentralDeploymentValidation and mavenCentralAutomaticPublishing are used for the default values of the 2 parameters when they are not passed explicitly. This allows to more easily override them in certain environments.
  • When isolated projects is enabled the module/project specific gradle.properties files are now considered in

... (truncated)

Commits

Updates org.jetbrains:annotations from 26.0.2-1 to 26.1.0

Release notes

Sourced from org.jetbrains:annotations's releases.

26.1.0

  • @NotNullByDefault is not experimental anymore.
Changelog

Sourced from org.jetbrains:annotations's changelog.

Version 26.1.0

  • @NotNullByDefault is not experimental anymore.
Commits

Updates com.squareup.okhttp3:okhttp from 5.3.2 to 5.4.0

Changelog

Sourced from com.squareup.okhttp3:okhttp's changelog.

Version 5.4.0

2026-06-08

  • New: Add superpowers to interceptors. Interceptors can now override anything settable on OkHttpClient.Builder, such as the cache, connection pool, socket factory, and DNS. We expect this will allow most users to use interceptors everywhere, insted of mixing and matching interceptors with custom Call.Factory wrappers.
  • Fix: Limit each HTTP/2 response to 256 KiB of total headers.
  • Upgrade: [kotlinx.coroutines 1.11.0][coroutines_1_11_0]. This is used by the optional okhttp-coroutines artifact.
  • Upgrade: [GraalVM 25.0.3][graalvm_25].
  • Upgrade: [Okio 3.17.0][okio_3_17_0].
Commits

Updates com.google.code.gson:gson from 2.13.2 to 2.14.0

Release notes

Sourced from com.google.code.gson:gson's releases.

Gson 2.14.0

What's Changed

  • Add type adapters for java.time classes by @​eamonnmcmanus in google/gson#2948

    When the java.time API is available, Gson automatically can read and write instances of classes like Instant and Duration. The format it uses essentially freezes the JSON representation that ReflectiveTypeAdapterFactory established by default, based on the private fields of java.time classes. That's not a great representation, but it is understandable. Changing it to anything else would break compatibility with systems that are expecting the current format.

    With this change, Gson no longer tries to access private fields of these classes using reflection. So it is no longer necessary to run with --add-opens for these classes on recent JDKs.

  • Remove com.google.gson.graph by @​eamonnmcmanus in google/gson#2990.

    This package was not part of any released artifact and depended on Gson internals in potentially problematic ways.

  • Validate that strings being parsed as integers consist of ASCII characters by @​eamonnmcmanus in google/gson#2995

    Previously, strings could contain non-ASCII Unicode digits and still be parsed as integers. That's inconsistent with how JSON numbers are treated.

  • Fix duplicate key detection when first value is null by @​andrewstellman in google/gson#3006

    This could potentially break code that was relying on the incorrect behaviour. For example, this JSON string was previously accepted but will no longer be: {"foo": null, "foo": bar}.

  • Remove Serializable from internal Type implementation classes. by @​eamonnmcmanus in google/gson#3011

    The nested classes ParameterizedTypeImpl, GenericArrayTypeImpl, and WildcardTypeImpl in GsonTypes are implementations of the corresponding types (without Impl) in java.lang.reflect. For some reason, they were serializable, even though the java.lang.reflect implementations are not. Having unnecessarily serializable classes could conceivably have been a security problem if they were part of a larger exploit using serialization. (We do not consider this a likely scenario and do not suggest that you need to update Gson just to get this change.)

  • Add LegacyProtoTypeAdapterFactory. by @​eamonnmcmanus in google/gson#3014

    This is not part of any released artifact, but may be of use when trying to fix code that is currently accessing the internals of protobuf classes via reflection.

  • Make AppendableWriter do flush and close if delegation object supports by @​MukjepScarlet in google/gson#2925

Other less visible changes

New Contributors

Full Changelog: google/gson@gson-parent-2.13.2...gson-parent-2.14.0

Commits
  • 3ff35d6 [maven-release-plugin] prepare release gson-parent-2.14.0
  • a3024fd Bump the maven group with 13 updates (#3002)
  • 5689ffe Bump the github-actions group across 1 directory with 3 updates (#3018)
  • 48db33c Add LegacyProtoTypeAdapterFactory. (#3014)
  • 53d703e Update outdated comment regarding serializable types (#3012)
  • 0189b72 Remove Serializable from internal Type implementation classes. (#3011)
  • f4d371d Fix duplicate key detection when first value is null (#3006)
  • 27d9ba1 Fix typo in README (JPMS dependencies section) (#3005)
  • 1fa9b7a Validate that strings being parsed as integers consist of ASCII characters (#...
  • b7d5954 Add iterator fail-fast tests for LinkedTreeMap.clear() (#2992)
  • Additional commits viewable in compare view

Updates org.seleniumhq.selenium:selenium-java from 4.44.0 to 4.45.0

Release notes

Sourced from org.seleniumhq.selenium:selenium-java's releases.

Selenium 4.45.0

Detailed Changelogs by Component

Java     |     Python     |     DotNet     |     Ruby     |     JavaScript

What's Changed

... (truncated)

Commits
  • cd6a3cd [build] Prepare for release of selenium-4.45.0 (#17680)
  • 15fad06 [build] Automated Browser Version Update (#17679)
  • cb9b6fd [grid] Add support Redis-backed for SessionQueue (#17678)
  • 18bb1d9 [py] terminate driver service process when start() fails to connect (#17651)
  • b3164ef [grid] add HtmlUnit browser logo to Grid UI (#17656)
  • bb741bd [build] Automated Browser Version Update (#17658)
  • 887237c [py] translate continue_request/continue_response kwargs to BiDi wire format ...
  • f53de51 [rb] run minimize test on linux now that #17644 fixed fluxbox startup
  • 3f37cce [rb] set window state before each window test instead of resetting driver
  • 2bfb990 [rb] skip Safari double_click action tests
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the production-dependencies group across 1 director…
e8c4b18 
…y with 5 updates

Bumps the production-dependencies group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [com.vanniktech.maven.publish](https://github.com/vanniktech/gradle-maven-publish-plugin) | `0.30.0` | `0.37.0` |
| [org.jetbrains:annotations](https://github.com/JetBrains/java-annotations) | `26.0.2-1` | `26.1.0` |
| [com.squareup.okhttp3:okhttp](https://github.com/square/okhttp) | `5.3.2` | `5.4.0` |
| [com.google.code.gson:gson](https://github.com/google/gson) | `2.13.2` | `2.14.0` |
| [org.seleniumhq.selenium:selenium-java](https://github.com/SeleniumHQ/selenium) | `4.44.0` | `4.45.0` |



Updates `com.vanniktech.maven.publish` from 0.30.0 to 0.37.0
- [Release notes](https://github.com/vanniktech/gradle-maven-publish-plugin/releases)
- [Changelog](https://github.com/vanniktech/gradle-maven-publish-plugin/blob/main/CHANGELOG.md)
- [Commits](vanniktech/gradle-maven-publish-plugin@0.30.0...0.37.0)

Updates `org.jetbrains:annotations` from 26.0.2-1 to 26.1.0
- [Release notes](https://github.com/JetBrains/java-annotations/releases)
- [Changelog](https://github.com/JetBrains/java-annotations/blob/master/CHANGELOG.md)
- [Commits](JetBrains/java-annotations@26.0.2-1...26.1.0)

Updates `com.squareup.okhttp3:okhttp` from 5.3.2 to 5.4.0
- [Changelog](https://github.com/square/okhttp/blob/master/CHANGELOG.md)
- [Commits](lysine-dev/okhttp@parent-5.3.2...parent-5.4.0)

Updates `com.google.code.gson:gson` from 2.13.2 to 2.14.0
- [Release notes](https://github.com/google/gson/releases)
- [Changelog](https://github.com/google/gson/blob/main/CHANGELOG.md)
- [Commits](google/gson@gson-parent-2.13.2...gson-parent-2.14.0)

Updates `org.seleniumhq.selenium:selenium-java` from 4.44.0 to 4.45.0
- [Release notes](https://github.com/SeleniumHQ/selenium/releases)
- [Commits](SeleniumHQ/selenium@selenium-4.44.0...selenium-4.45.0)

---
updated-dependencies:
- dependency-name: com.vanniktech.maven.publish
  dependency-version: 0.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: org.jetbrains:annotations
  dependency-version: 26.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: com.squareup.okhttp3:okhttp
  dependency-version: 5.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: com.google.code.gson:gson
  dependency-version: 2.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: org.seleniumhq.selenium:selenium-java
  dependency-version: 4.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Jun 22, 2026

Copy link
Copy Markdown
Contributor Author

Assignees

The following users could not be added as assignees: R2turnTrue. Either the username does not exist or it does not have the correct permissions to be added as an assignee.

Labels

The following labels could not be found: gradle. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Jun 22, 2026
bbobbogi pushed a commit that referenced this pull request Jul 18, 2026
@hhgyu
chore(deps): bump production deps + fix vanniktech maven-publish 0.37…
d98157f 
… migration

Supersedes #21. Applies the dependabot production-dependencies group
updates and adapts the build script to the 0.34.0+ plugin DSL:

- com.vanniktech.maven.publish 0.30.0 -> 0.37.0
  - SonatypeHost was removed in 0.34.0 (OSSRH shutdown); the plugin now
    auto-detects Maven Central Portal, so call publishToMavenCentral()
    without arguments.
- jetbrains-annotations 26.0.2-1 -> 26.1.0
- okhttp 5.3.2 -> 5.4.0
- gson 2.13.2 -> 2.14.0
- selenium 4.44.0 -> 4.45.0

Verified locally with ./gradlew compileJava compileTestJava.
@bbobbogi

bbobbogi commented Jul 18, 2026

Copy link
Copy Markdown
Owner

Superseded by main commit d98157f, which applies the same dependency updates plus the required build script change for vanniktech/maven-publish 0.37.0 (SonatypeHost was removed in 0.34.0). Closing as duplicate.

@bbobbogi bbobbogi closed this Jul 18, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jul 18, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/gradle/production-dependencies-2e54e5685d branch July 18, 2026 00:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@bbobbogi