[dependabot]

Bumps com.gradleup.shadow from 9.3.1 to 9.6.1.

Release notes

Sourced from com.gradleup.shadow's releases.

9.6.1

Changed

• Use GradleException for expected build failures. (#2113)

Fixed

• Preserve repeated lines in R8 rule files when using minimize { r8 { ... } }. (#2115)

9.6.0

Added

• Extract R8 rules from dependency JARs when using minimize { r8 { ... } }. (#2089)

Changed

• Rename ShadowDslMarker to ShadowDsl. (#2091)
• POTENTIALLY BREAKING: Apply @ShadowDsl to ShadowJar, ResourceTransformer, DependencyFilter, and Relocator. (#2090)
  This restricts nested DSL configuration blocks from implicitly calling outer receiver APIs in Kotlin script files.

Fixed

• Validate ZIP entry names to prevent Zip Slip path traversal.
• Avoid resolving unused R8 dependency. (#2101)

9.5.1

Fixed

• Fix eager calls for toolchainSpec in Kotlin DSL. (#2087)

9.5.0

[!NOTE] With the introduction of DuplicatesStrategy checking for transformers, you may see warnings like:

'META-INF/...kotlin_module' is matched by com.github.jengelman.gradle.plugins.shadow.transformers.KotlinModuleMetadataTransformer but its DuplicatesStrategy is EXCLUDE — duplicates may be silently dropped before the transformer processes them.

If you do not need Kotlin module metadata remapping, you can disable it:

tasks.shadowJar {
  @Suppress("DEPRECATION") // This flag will be disabled and removed in the next major version of Shadow.
  enableKotlinModuleRemapping = false
}

Added

• Check DuplicatesStrategy for merging transformers. (#2026)

... (truncated)

Changelog

Sourced from com.gradleup.shadow's changelog.

9.6.1 - 2026-07-22

Changed

• Use GradleException for expected build failures. (#2113)

Fixed

• Preserve repeated lines in R8 rule files when using minimize { r8 { ... } }. (#2115)

9.6.0 - 2026-07-16

Added

• Extract R8 rules from dependency JARs when using minimize { r8 { ... } }. (#2089)

Changed

• Rename ShadowDslMarker to ShadowDsl. (#2091)
• POTENTIALLY BREAKING: Apply @ShadowDsl to ShadowJar, ResourceTransformer, DependencyFilter, and Relocator. (#2090)
  This restricts nested DSL configuration blocks from implicitly calling outer receiver APIs in Kotlin script files.

Fixed

• Validate ZIP entry names to prevent Zip Slip path traversal.
• Avoid resolving unused R8 dependency. (#2101)

9.5.1 - 2026-07-06

Fixed

• Fix eager calls for toolchainSpec in Kotlin DSL. (#2087)

9.5.0 - 2026-07-06

[!NOTE] With the introduction of DuplicatesStrategy checking for transformers, you may see warnings like:

'META-INF/...kotlin_module' is matched by com.github.jengelman.gradle.plugins.shadow.transformers.KotlinModuleMetadataTransformer but its DuplicatesStrategy is EXCLUDE — duplicates may be silently dropped before the transformer processes them.

If you do not need Kotlin module metadata remapping, you can disable it:

tasks.shadowJar {
  @Suppress("DEPRECATION") // This flag will be disabled and removed in the next major version of Shadow.
  enableKotlinModuleRemapping = false
}

... (truncated)

Commits

• 185da5d Prepare version 9.6.1
• b309bc5 Extract addIncludedDependencies (#2116)
• 46b3544 Preserve repeated lines in R8 rule files (#2115)
• c0d4f0d Revert "Reland Tapmoc (#2111)"
• ff1809f Use GradleException for expected build failures (#2113)
• dc0ee64 Update plugin tapmoc to v0.4.2 (#2112)
• 398afcd Reland Tapmoc (#2111)
• 3ca69d5 Gradle 9.7.0-rc-1 (#2110)
• aaaacd2 Prepare next development version
• fb36668 Prepare version 9.6.0
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 102b5f4a-5c2c-44fa-b80b-3597e3bc9411

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}