Update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
org.jetbrains.intellij.platform	2.11.0 → 2.14.0
com.gradle:develocity-gradle-plugin (source)	4.3.1 → 4.4.1
com.autonomousapps:dependency-analysis-gradle-plugin	3.5.1 → 3.9.0
com.vanniktech:gradle-maven-publish-plugin	0.35.0 → 0.36.0
com.ncorti.ktfmt.gradle	0.25.0 → 0.26.0
com.ncorti.ktfmt.gradle:plugin	0.25.0 → 0.26.0
com.squareup.wire:wire-runtime	5.5.0 → 5.5.1
com.google.truth:truth	1.4.4 → 1.4.5
com.fueledbycaffeine.spotlight:buildscript-utils	1.6.8 → 1.6.10
com.fueledbycaffeine.spotlight:spotlight-gradle-plugin	1.6.8 → 1.6.10
com.squareup.okio:okio	3.16.4 → 3.17.0
androidx.lint:lint-gradle (source)	1.0.0-alpha05 → 1.0.0-beta01
org.jetbrains.kotlinx:kotlinx-serialization-json	1.10.0 → 1.11.0
com.autonomousapps.testkit	0.17 → 0.18
io.insert-koin:koin-core (source)	4.1.1 → 4.2.1
com.fueledbycaffeine.spotlight	1.6.6 → 1.6.10
org.eclipse.jgit:org.eclipse.jgit	7.5.0.202512021534-r → 7.6.0.202603022253-r
com.autonomousapps:gradle-testkit-truth	1.6.1 → 1.7.0
com.autonomousapps:gradle-testkit-plugin	0.17 → 0.18
com.gradleup.shadow	9.3.1 → 9.4.1
com.autonomousapps:gradle-testkit-support	0.22 → 0.23

---

Release Notes

autonomousapps/dependency-analysis-android-gradle-plugin (com.autonomousapps:dependency-analysis-gradle-plugin)

v3.9.0

• (Reverted) Compiled against Kotlin 2.3.20. Compiling against Kotlin 2.2.21 again, with language level 2.2.

v3.8.0

• [feat]: record lambda in binaryClassAccesses.
• [feat]: support analysis of a Gradle version catalog dependency.
• [feat]: remove unused 'file' property.
• Compiled against Kotlin 2.3.20.

v3.7.0

• [feat]: Expose useParenthesesForGroovy configuration for Groovy DSL syntax control.
• [fix]: fix regex for excluding all *Generated annotations.
• [fix]: don't attempt to suggest upgrading an undeclared 'parent' dependency of a KMP dependency.
• [fix]: the 'androidMain' source set is special.
• [chore]: Compiled against Kotlin 2.2 and Gradle 9.4.1.
• [chore]: add Code of Conduct.

v3.6.1

• [Fix]: use compilation.disambiguatedName for crafting the task suffix.

v3.6.0

• [Breaking]: min version of Android Gradle Plugin (AGP) is now 8.10.0.
• [Feat]: support KMP projects with JVM targets.
• [Feat]: support KMP projects with Android targets.
• [Feat]: update console report to be more idiomatic for KMP.
• [Feat]: implement ABI inclusions filter.
• [Feat]: add lifecycle resolveExternalDependencies task.
• [Fix]: improve Class.forName handling.
• [Fix]: remove dependency to javax.inject.
• [Fix]: potential resource leak in JarExploder.
• [Fix]: duplicate class detection for annotations.
• [Fix]: use latest-kotlin editor.
• [Refactor]: move two public types to an internal package to exclude from published api, and exclude the
  com.autonomousapps.model.internal package from the published api.
• [Refactor]: moved a lot of task-registration code into AbstractDependencyAnalyzer.
• [Docs]: add link to maven-hijack blog post.

vanniktech/gradle-maven-publish-plugin (com.vanniktech:gradle-maven-publish-plugin)

v0.36.0

Compare Source

BREAKING

• Updated minimum supported JDK, Gradle, Android Gradle Plugin and Kotlin versions.
• Removed support for Dokka v1, it's now required to use Dokka in v2 mode.
• Mark DirectorySignatureType internal.

Behavior changes

• validateDeployment now has the DeploymentValidation enum as type instead of being a boolean. The default
  is now to just wait for the VALIDATED state. The previous behavior can be achieved by setting it to PUBLISHED.
  NONE can be used for disabling the validation completely.
• When calling configure(...) manually to configure what to publish and not passing javadocJar explicity,
  the plugin now defaults to publishing an empty javadoc jar.

Features

• Android projects now support using Dokka for javadoc creation, this will happen automatically
  when using the default options and the Dokka plugin is applied to the project.
• Added consistent JavadocJar and SourcesJar options to configureBasedOnAppliedPlugins and to all
  applicable project types that can be passed to configure. The previous Boolean based versions have
  been deprecated.
• When enabling Maven Central publishing through the DSL, the mavenCentralDeploymentValidation and
  mavenCentralAutomaticPublishing are used for the default values of the 2 parameters when they are not passed
  explicitly. This allows to more easily override them in certain environments.
• When isolated projects is enabled the module/project specific gradle.properties files are now considered in
  the same way they are when isolated projects is disabled.

Improvements

• Better error message when Maven Central credentials are missing.

Minimum supported versions

• JDK 17
• Gradle 9.0.0
• Android Gradle Plugin 8.13.0
• Kotlin Gradle Plugin 2.2.0

Compatibility tested up to

• JDK 25
• Gradle 9.3.0
• Gradle 9.4.0-milestone-4
• Android Gradle Plugin 8.13.2
• Android Gradle Plugin 9.0.0
• Android Gradle Plugin 9.1.0-alpha05
• Kotlin Gradle Plugin 2.3.0
• Kotlin Gradle Plugin 2.3.20-Beta1

square/wire (com.squareup.wire:wire-runtime)

v5.5.1

Compare Source

2026-03-05

Kotlin

• Add option to avoid making immutable copies for Kotlin generations (#​3513 by [Jeff Gulbronson][JGulbronson])
  If set to false, Wire will not use immutable copies for repeated or map fields.

wire {
  kotlin {
    makeImmutableCopies = false
  }
}

google/truth (com.google.truth:truth)

v1.4.5: 1.4.5

Compare Source

• Changed assertions like assertThat(nullMap).isEmpty() to fail with a useful failure message instead of throwing NullPointerException (and similarly for other "bogus" values, such as negative sizes). (da5d6e9)
• Made Kotlin's isInstanceOf(Int::class.java) (and Java's isInstanceOf(int.class)) a valid way to check for Int/Integer instances. (974ef19)
• Improved isWithin to pretty-print numbers in its failure messages. (de78553, 07318c2)
• Improved some assertions that print class names to print simpler names (e.g., Integer instead of java.lang.Integer). (0ba72d6)
• Changed ExpectFailure to never generate "value of" lines based on bytecode. This slightly simplifies writing new tests with ExpectFailure and prevents future behavior changes in some ExpectFailure tests that already exist. However, it may also require changes to other existing ExpectFailure tests to remove or change any assertions about the "value of" line. (3caa0e8)
• Our Android minSdkVersion is now 23 (Marshmallow). This follows the minimum of Google's foundational Android libraries, and we expect it to have no practical impact on users. (c85c75c)
• Changed our GWT/J2CL artifact to omit usages of @NullMarked. This was making all our types non-null in those environments, since we don't yet use @Nullable in the GWT/J2CL artifact. (6392d37)

joshfriend/spotlight (com.fueledbycaffeine.spotlight:buildscript-utils)

v1.6.10

1.6.10

v1.6.9

IDE plugin

• Add "Replace Spotlight with Selection" action (Cmd+Shift+I) to replace the entire module selection with the currently selected project(s)
• Add notifications when a project is added/removed from Spotlight
• Actions are now dumb-aware
• Fix error returning null widget presentation
• Bump minimum and target IntelliJ version to 252

square/okio (com.squareup.okio:okio)

v3.17.0

2026-03-11

• New: Adjust down the Kotlin stdlib dependency to [Kotlin 2.1.21][kotlin_2_1_21]. Okio is built
  with an up-to-date Kotlin compiler (2.2.21), but depends on an older kotlin-stdlib. We're doing
  this so you can update Okio and Kotlin independently.

• Fix: Return the correct timestamp in FileMetadata.createdAtMillis on Kotlin/Native on UNIX
  platforms. We were incorrectly using the POSIX ctime (change time) instead of the
  birthtime. With this fix Okio now prefers statx() over stat() on native platforms. This
  API first appeared in Linux in 4.11 (2017) and Android in API 30 (2020).

Kotlin/kotlinx.serialization (org.jetbrains.kotlinx:kotlinx-serialization-json)

v1.11.0

==================

This release is based on Kotlin 2.3.20 and provides new Json exceptions API and some bugfixes and improvements.

Expose Json exceptions structure

To make working with exceptions easier and providing proper error codes in e.g., REST APIs,
classes JsonException, JsonDecodingException, and JsonEncodingException are now public.
They have relevant public properties, such as shortMessage, path, offset, and others.
This API is currently experimental, and we're going to improve it further in the subsequent releases.
See the linked issues for the details: #​1930, #​1877.

Ability to hide user input from exception messages for security/privacy reasons.

Historically, exception messages in kotlinx.serialization often included the input Json itself for debuggability reason.
Such behavior may pose additional challenges for logging, analytics, and other systems, since
a system is not always allowed to store user data due to privacy/security reasons, which imposes additional sanitation logic.
To address this issue, a new property exceptionsWithDebugInfo is added to JsonConfiguration.
Disable it to hide user input from exception messages.
IMPORTANT: This behavior will be enabled by default when this property becomes stable.
See #​2590 for more details.

Bugfixes and improvements

• CBOR: Relax value range check when decoding numbers (#​3167)
• Use a specialized writeDecimalLong method for IO stream integrations in Json (#​3152)

InsertKoinIO/koin (io.insert-koin:koin-core)

v4.2.1: Koin 4.2.1

Compare Source

Support for Compile Safety with Koin Compiler 1.0.0-RC1

• Koin Compiler Plugin 1.0.0-RC1 - https://github.com/InsertKoinIO/koin-compiler-plugin/releases/tag/1.0.0-RC1

Bug Fixes

• Fix stacked-params lookup on linked scopes (#​2387) — The 4.2.0 resolver rewrite (CoreResolverV2) walked linked scopes but dropped the per-parent stacked-parameters check that 4.1.x performed via recursion. This broke patterns where AndroidParametersHolder is stacked on the factory scope by KoinViewModelFactory and SavedStateHandle is then resolved from a child ViewModel scope. Linked-scope resolution now also checks stacked params on each parent scope.

• Restore ABI compatibility for runOnKoinStarted (#​2391) — The 4.2.0 release inadvertently broke binary compatibility for runOnKoinStarted on JVM. Fixed by restoring the original JVM class name via @JvmName/@JvmMultifileClass annotations.

• Fix scope _closed concurrency issue (#​2389) — The Scope._closed flag was not volatile, which could cause stale reads under concurrent access.

Improvements

• Improved Scope resolution error messages — CoreResolverV2 now provides clearer error messages when scope resolution fails, making it easier to diagnose misconfigured scopes.

• Added apiCheck to CI — Binary compatibility validation (kotlinx.binary-compatibility-validator) now runs on every PR to prevent future ABI breaks.

Documentation

• parametersOf type-collision warning (#​2328) — Added a caution note explaining that when a value passed via parametersOf has the same type as the requested definition, Koin returns the value directly and skips the factory block. Suggests using a wrapper type as a workaround.

Contributors

Thanks to the following contributors for this release:

• @​arnaudgiuliani (Arnaud Giuliani)
• @​inemtsev (Ilya Nemtsev) — fix for scope closed concurrency issue (#​2389)

v4.2.0

Compare Source

Kotlin 2.3.20

New Features

• Ktor 3.4 DI Bridge — Full integration with Ktor's new DI system (ktor-server-di), bridging Ktor ↔ Koin dependency injection both ways
• Dagger Bridge (koin-dagger-bridge) — New module to help inject Koin components from Dagger side
• AndroidX Navigation 3 support — Entry point provider with metadata parameter passing (animations, etc.), generic EntryProvider, and navigation scopes
• Navigation Scope for Compose Nav 2 — Added scoped navigation support for Compose Navigation 2
• Lazy Modules — Parallel loading at startup for improved performance, with benchmarks
• strictOverride option — New definition option to override explicitly
• koinActivityInject — Helper to retrieve dependencies against Activity scope
• Koin Compiler Stubs — Added stubs for KoinApplication.modules() functions
• KoinApplication.withConfiguration() — New configuration support

Performance & Stability

• Core Resolver V2 — Fixed parameter stack propagation, injected params handling, and child scope/ViewModel scope resolution
• Scope Resolution & Thread Safety — Performance optimization with safer ScopeFactory protecting all operations from parallel calls
• ThreadLocal loading optimization — Avoid cost per Scope (#​2306)
• getAll no longer sorted by default — Instances come as declared; sort on purpose if needed
• Params stack access optimization

Bug Fixes

• Fix sharedKoinViewModel with type-safe navigation routes (#​2293)
• Fix qualified name usage in WASM (#​2312)
• Fix premature release of scope & context in Compose — don't drop in onForgotten (#​2274)
• Fix crashing declarations for LocalKoinScope & LocalKoinApplication
• Fix Compose Koin Context Loader and Entry Points (#​2327)
• Fix CoreResolution with Child Scopes / ViewModelScope (#​2325)
• Fix Scope Archetypes Qualifier in plugin support functions
• Fix qualifier conversion

Breaking Changes

• minSdk raised to 23 for Android
• module renamed to lazyModule in some contexts
• BeanDef constructor change (API signature update)

Dependencies

• Kotlin 2.3.20
• Ktor 3.4
• JetBrains Compose 1.10.2
• AndroidX Lifecycle 2.10.0
• AndroidX Navigation 2.9.7 / Nav3 1.0.1

GradleUp/shadow (com.gradleup.shadow)

v9.4.1

Compare Source

Changed

• Update Kotlin to 2.3.20. (#​1978)

v9.4.0

Compare Source

Added

• Support Isolated Projects. (#​1139)

Changed

• Allow opting out of adding shadowJar into assemble lifecycle. (#​1939)

  shadow {
    // Disable making `assemble` task depend on `shadowJar`. This is enabled by default.
    addShadowJarToAssembleLifecycle = false
  }

• Stop catching ZipException when writing entries. (#​1970)

Fixed

• Fix interaction with Gradle artifact transforms. (#​1345)
• Fix skipStringConstants per-relocator behavior in mapName. (#​1968)
• Fix failing for non-existent class directories. (#​1976)

v9.3.2

Compare Source

Changed

• Stop moving gradleApi dependency from api to compileOnly for Gradle 9.4+. (#​1919)
• Log warnings for duplicates in the final JAR. (#​1931)

Fixed

• Fix relocation patterns not included in task fingerprint. (#​1933)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.