renovate-bot opened a new pull request, #6687: URL: https://github.com/apache/fineract/pull/6687
> [!NOTE] > This PR body was truncated due to platform limits. This PR contains the following updates: | Package | Type | Update | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---|---|---| | [actions/download-artifact](https://redirect.github.com/actions/download-artifact) | action | patch | `v8.0.1` → `v8.0.2` |  |  | | [actions/setup-java](https://redirect.github.com/actions/setup-java) | action | minor | `v6.0.1` → `v6.1.0` |  |  | | [apache/kafka](https://redirect.github.com/apache/kafka) | | minor | `4.2.0-rc2` → `4.4.0-rc2` |  |  | | [gradle](https://gradle.org) ([source](https://redirect.github.com/gradle/gradle)) | | minor | `9.7.1` → `9.8.1` |  |  | | [gradle/actions](https://redirect.github.com/gradle/actions) | action | minor | `v6.3.0` → `v6.4.0` |  |  | | localstack/localstack | | minor | `2.1` → `2.3` |  |  | | [mariadb](https://hub.docker.com/_/mariadb) ([source](https://redirect.github.com/MariaDB/mariadb-docker)) | | minor | `12.2` → `12.3` |  |  | | [postgres](https://hub.docker.com/_/postgres) ([source](https://redirect.github.com/docker-library/postgres)) | service | minor | `18.3` → `18.6` |  |  | | [tomcat](https://hub.docker.com/_/tomcat) ([source](https://redirect.github.com/docker-library/tomcat)) | | patch | `10.1.59-jdk25-temurin` → `10.1.61-jdk25-temurin` |  |  | | [zizmorcore/zizmor-action](https://redirect.github.com/zizmorcore/zizmor-action) | action | minor | `v0.6.4` → `v0.7.1` |  |  | | [at.yawk.lz4:lz4-java](https://redirect.github.com/yawkat/lz4-java) | devDependencies | minor | `1.11.4` → `1.12.0` |  |  | | [io.netty:netty-transport-native-unix-common](https://netty.io/) ([source](https://redirect.github.com/netty/netty)) | devDependencies | minor | `4.1.138.Final` → `4.2.19.Final` |  |  | | [io.netty:netty-transport-classes-epoll](https://netty.io/) ([source](https://redirect.github.com/netty/netty)) | devDependencies | minor | `4.1.138.Final` → `4.2.19.Final` |  |  | | [io.netty:netty-transport](https://netty.io/) ([source](https://redirect.github.com/netty/netty)) | devDependencies | minor | `4.1.138.Final` → `4.2.19.Final` |  |  | | [io.netty:netty-resolver](https://netty.io/) ([source](https://redirect.github.com/netty/netty)) | devDependencies | minor | `4.1.138.Final` → `4.2.19.Final` |  |  | | [io.netty:netty-handler-proxy](https://netty.io/) ([source](https://redirect.github.com/netty/netty)) | devDependencies | minor | `4.1.138.Final` → `4.2.19.Final` |  |  | | [io.netty:netty-handler](https://netty.io/) ([source](https://redirect.github.com/netty/netty)) | devDependencies | minor | `4.1.138.Final` → `4.2.19.Final` |  |  | | [io.netty:netty-codec-socks](https://netty.io/) ([source](https://redirect.github.com/netty/netty)) | devDependencies | minor | `4.1.138.Final` → `4.2.19.Final` |  |  | | [io.netty:netty-codec-protobuf](https://netty.io/) ([source](https://redirect.github.com/netty/netty)) | devDependencies | minor | `4.1.138.Final` → `4.2.19.Final` |  |  | | [io.netty:netty-codec-marshalling](https://netty.io/) ([source](https://redirect.github.com/netty/netty)) | devDependencies | minor | `4.1.138.Final` → `4.2.19.Final` |  |  | | [io.netty:netty-codec-http2](https://netty.io/) ([source](https://redirect.github.com/netty/netty)) | devDependencies | minor | `4.1.138.Final` → `4.2.19.Final` |  |  | | [io.netty:netty-codec-http](https://netty.io/) ([source](https://redirect.github.com/netty/netty)) | devDependencies | minor | `4.1.138.Final` → `4.2.19.Final` |  |  | | [io.netty:netty-codec-compression](https://netty.io/) ([source](https://redirect.github.com/netty/netty)) | devDependencies | minor | `4.1.138.Final` → `4.2.19.Final` |  |  | | [io.netty:netty-codec-base](https://netty.io/) ([source](https://redirect.github.com/netty/netty)) | devDependencies | minor | `4.1.138.Final` → `4.2.19.Final` |  |  | | [io.netty:netty-codec](https://netty.io/) ([source](https://redirect.github.com/netty/netty)) | devDependencies | minor | `4.1.138.Final` → `4.2.19.Final` |  |  | | [io.netty:netty-common](https://netty.io/) ([source](https://redirect.github.com/netty/netty)) | devDependencies | minor | `4.1.138.Final` → `4.2.19.Final` |  |  | | [io.netty:netty-buffer](https://netty.io/) ([source](https://redirect.github.com/netty/netty)) | devDependencies | minor | `4.1.138.Final` → `4.2.19.Final` |  |  | | [com.nimbusds:nimbus-jose-jwt](https://bitbucket.org/connect2id/nimbus-jose-jwt) | devDependencies | minor | `10.9` → `10.10` |  |  | | [org.apache.commons:commons-lang3](https://commons.apache.org/proper/commons-lang/) ([source](https://gitbox.apache.org/repos/asf/commons-lang.git)) | devDependencies | minor | `3.20.0` → `3.21.0` |  |  | | [io.cucumber:cucumber-spring](https://cucumber.io/) ([source](https://redirect.github.com/cucumber/cucumber-jvm)) | devDependencies | patch | `7.34.3` → `7.34.9` |  |  | | [io.cucumber:cucumber-junit-platform-engine](https://cucumber.io/) ([source](https://redirect.github.com/cucumber/cucumber-jvm)) | devDependencies | patch | `7.34.3` → `7.34.9` |  |  | | [io.cucumber:cucumber-java8](https://cucumber.io/) ([source](https://redirect.github.com/cucumber/cucumber-jvm)) | devDependencies | patch | `7.34.3` → `7.34.9` |  |  | | [io.cucumber:cucumber-java](https://cucumber.io/) ([source](https://redirect.github.com/cucumber/cucumber-jvm)) | devDependencies | patch | `7.34.3` → `7.34.9` |  |  | | [org.apache.sshd:sshd-core](https://www.apache.org/) ([source](https://redirect.github.com/apache/mina-sshd)) | devDependencies | minor | `2.17.1` → `2.20.0` |  |  | | [org.apache.sshd:sshd-common](https://www.apache.org/) ([source](https://redirect.github.com/apache/mina-sshd)) | devDependencies | minor | `2.17.1` → `2.20.0` |  |  | | [org.postgresql:postgresql](https://jdbc.postgresql.org) ([source](https://redirect.github.com/pgjdbc/pgjdbc)) | devDependencies | patch | `42.7.13` → `42.7.14` |  |  | | [org.apache.avro:avro](https://avro.apache.org) ([source](https://redirect.github.com/apache/avro)) | devDependencies | patch | `1.12.1` → `1.12.2` |  |  | | [io.rest-assured:xml-path](https://rest-assured.io/) ([source](https://redirect.github.com/rest-assured/rest-assured)) | devDependencies | minor | `6.0.1` → `6.2.0` |  |  | | [io.rest-assured:json-path](https://rest-assured.io/) ([source](https://redirect.github.com/rest-assured/rest-assured)) | devDependencies | minor | `6.0.1` → `6.2.0` |  |  | | [io.rest-assured:rest-assured](https://rest-assured.io/) ([source](https://redirect.github.com/rest-assured/rest-assured)) | devDependencies | minor | `6.0.1` → `6.2.0` |  |  | | [org.hibernate.validator:hibernate-validator](https://hibernate.org/validator) ([source](https://redirect.github.com/hibernate/hibernate-validator)) | devDependencies | patch | `9.1.3.Final` → `9.1.5.Final` |  |  | | [io.swagger.core.v3:swagger-core-jakarta](https://redirect.github.com/swagger-api/swagger-core) | devDependencies | patch | `2.2.49` → `2.2.55` |  |  | | [io.swagger.core.v3:swagger-jaxrs2-jakarta](https://redirect.github.com/swagger-api/swagger-core) | devDependencies | patch | `2.2.49` → `2.2.55` |  |  | | [io.swagger.core.v3:swagger-annotations-jakarta](https://redirect.github.com/swagger-api/swagger-core) | devDependencies | patch | `2.2.49` → `2.2.55` |  |  | | [org.apache.activemq:activemq-client](http://activemq.apache.org) ([source](https://redirect.github.com/apache/activemq)) | devDependencies | minor | `6.2.5` → `6.3.2` |  |  | | [org.springdoc:springdoc-openapi-starter-webmvc-ui](https://springdoc.org/) ([source](https://redirect.github.com/springdoc/springdoc-openapi)) | devDependencies | minor | `3.0.3` → `3.1.1` |  |  | | [org.apache.maven:maven-artifact](https://maven.apache.org/) ([source](https://redirect.github.com/apache/maven)) | devDependencies | minor | `3.9.16` → `3.10.0` |  |  | | [org.eclipse.jgit:org.eclipse.jgit.ssh.apache](https://eclipse.gerrithub.io/admin/repos/eclipse-jgit/jgit) | devDependencies | minor | `7.6.0.202603022253-r` → `7.8.0.202609011348-r` |  |  | | [org.eclipse.jgit:org.eclipse.jgit.gpg.bc](https://eclipse.gerrithub.io/admin/repos/eclipse-jgit/jgit) | devDependencies | minor | `7.6.0.202603022253-r` → `7.8.0.202609011348-r` |  |  | | [org.eclipse.jgit:org.eclipse.jgit](https://eclipse.gerrithub.io/admin/repos/eclipse-jgit/jgit) | devDependencies | minor | `7.6.0.202603022253-r` → `7.8.0.202609011348-r` |  |  | | [org.bouncycastle:bcpg-jdk18on](https://www.bouncycastle.org/download/bouncy-castle-java/) ([source](https://redirect.github.com/bcgit/bc-java)) | devDependencies | minor | `1.84` → `1.86` |  |  | | [org.bouncycastle:bcutil-jdk18on](https://www.bouncycastle.org/download/bouncy-castle-java/) ([source](https://redirect.github.com/bcgit/bc-java)) | devDependencies | minor | `1.84` → `1.86` |  |  | | [org.bouncycastle:bcprov-jdk18on](https://www.bouncycastle.org/download/bouncy-castle-java/) ([source](https://redirect.github.com/bcgit/bc-java)) | devDependencies | minor | `1.84` → `1.86` |  |  | | [org.bouncycastle:bcpkix-jdk18on](https://www.bouncycastle.org/download/bouncy-castle-java/) ([source](https://redirect.github.com/bcgit/bc-java)) | devDependencies | minor | `1.84` → `1.86` |  |  | | [org.projectlombok:lombok](https://projectlombok.org) ([source](https://redirect.github.com/projectlombok/lombok)) | devDependencies | patch | `1.18.46` → `1.18.48` |  |  | | [commons-codec:commons-codec](https://commons.apache.org/proper/commons-codec/) ([source](https://redirect.github.com/apache/commons-codec)) | devDependencies | minor | `1.22.0` → `1.23.0` |  |  | | [org.mock-server:mockserver-junit-jupiter](https://www.mock-server.com) ([source](https://redirect.github.com/mock-server/mockserver-monorepo)) | devDependencies | minor | `5.14.0` → `5.15.0` |  |  | | [com.github.spotbugs:spotbugs-annotations](https://spotbugs.github.io/) ([source](https://redirect.github.com/spotbugs/spotbugs)) | devDependencies | minor | `4.9.8` → `4.10.5` |  |  | | [io.github.classgraph:classgraph](https://redirect.github.com/classgraph/classgraph) | devDependencies | patch | `4.8.184` → `4.8.199` |  |  | | [joda-time:joda-time](https://www.joda.org/joda-time/) ([source](https://redirect.github.com/JodaOrg/joda-time)) | devDependencies | minor | `2.14.2` → `2.15.0` |  |  | | [org.apache.tika:tika-parser-image-module](https://tika.apache.org/) ([source](https://redirect.github.com/apache/tika)) | devDependencies | patch | `3.3.0` → `3.3.3` |  |  | | org.cyclonedx.bom | plugin | minor | `3.4.1` → `3.5.1` |  |  | | com.gradleup.shadow | plugin | minor | `9.4.1` → `9.6.1` |  |  | | org.openapi.generator | plugin | minor | `7.22.0` → `7.26.0` |  |  | | [org.apache.tika:tika-parser-microsoft-module](https://tika.apache.org/) ([source](https://redirect.github.com/apache/tika)) | devDependencies | patch | `3.3.0` → `3.3.3` |  |  | | com.github.spotbugs | plugin | patch | `6.5.4` → `6.5.13` |  |  | | com.github.andygoossens.modernizer | plugin | minor | `1.13.0` → `1.15.0` |  |  | | io.swagger.core.v3.swagger-gradle-plugin | plugin | patch | `2.2.49` → `2.2.55` |  |  | | org.zeroturnaround.gradle.jrebel | plugin | patch | `1.2.2` → `1.2.3` |  |  | | org.nosphere.apache.rat | plugin | minor | `0.8.1` → `0.11.0` |  |  | | [org.apache.tika:tika-parser-miscoffice-module](https://tika.apache.org/) ([source](https://redirect.github.com/apache/tika)) | devDependencies | patch | `3.3.0` → `3.3.3` |  |  | | com.diffplug.spotless | plugin | patch | `8.10.2` → `8.10.4` |  |  | | org.barfuin.gradle.taskinfo | plugin | minor | `3.0.2` → `3.1.0` |  |  | | [org.apache.tika:tika-core](https://tika.apache.org/) ([source](https://redirect.github.com/apache/tika)) | devDependencies | patch | `3.3.0` → `3.3.3` |  |  | | [com.github.librepdf:openpdf](https://redirect.github.com/LibrePDF/OpenPDF) | devDependencies | patch | `3.0.4` → `3.0.5` |  |  | | [software.amazon.msk:aws-msk-iam-auth](https://docs.aws.amazon.com/msk/latest/developerguide/iam-access-control.html) ([source](https://redirect.github.com/aws/aws-msk-iam-auth)) | devDependencies | patch | `2.3.6` → `2.3.9` |  |  | | [org.apache.commons:commons-collections4](https://commons.apache.org/proper/commons-collections/) ([source](https://gitbox.apache.org/repos/asf?p=commons-collections.git)) | devDependencies | minor | `4.5.0` → `4.6.0` |  |  | | [com.google.googlejavaformat:google-java-format](https://redirect.github.com/google/google-java-format) | devDependencies | minor | `1.35.0` → `1.37.0` |  |  | | [com.google.guava:guava](https://redirect.github.com/google/guava) | devDependencies | minor | `33.6.0-jre` → `33.7.2-jre` |  |  | | [ch.qos.logback:logback-classic](http://logback.qos.ch) ([source](https://redirect.github.com/qos-ch/logback), [changelog](https://logback.qos.ch/news.html)) | devDependencies | minor | `1.5.38` → `1.6.5` |  |  | | [ch.qos.logback:logback-core](http://logback.qos.ch) ([source](https://redirect.github.com/qos-ch/logback), [changelog](https://logback.qos.ch/news.html)) | devDependencies | minor | `1.5.38` → `1.6.5` |  |  | | [org.glassfish.jersey:jersey-bom](https://projects.eclipse.org/projects/ee4j) ([source](https://redirect.github.com/eclipse-ee4j/ee4j)) | devDependencies | patch | `4.0.2` → `4.0.3` |  |  | | [software.amazon.awssdk:bom](https://aws.amazon.com/sdkforjava) | devDependencies | minor | `2.44.4` → `2.56.0` |  |  | | [org.mockito:mockito-bom](https://redirect.github.com/mockito/mockito) | devDependencies | minor | `5.23.0` → `5.24.0` |  |  | | [io.cucumber:cucumber-bom](https://cucumber.io/) ([source](https://redirect.github.com/cucumber/cucumber-jvm)) | devDependencies | patch | `7.34.3` → `7.34.9` |  |  | | [com.fasterxml.jackson:jackson-bom](https://redirect.github.com/FasterXML/jackson-bom) | devDependencies | patch | `2.22.3` → `2.22.4` |  |  | | [org.junit:junit-bom](https://junit.org/) ([source](https://redirect.github.com/junit-team/junit-framework)) | devDependencies | minor | `6.0.3` → `6.1.3` |  |  | | [org.jetbrains.kotlin:kotlin-bom](https://kotlinlang.org/) ([source](https://redirect.github.com/JetBrains/kotlin)) | devDependencies | minor | `2.3.21` → `2.4.21` |  |  | | [io.opentelemetry:opentelemetry-bom](https://redirect.github.com/open-telemetry/opentelemetry-java) | devDependencies | minor | `1.62.0` → `1.67.0` |  |  | | [io.awspring.cloud:spring-cloud-aws-dependencies](https://projects.spring.io/spring-cloud/) ([source](https://redirect.github.com/awspring/spring-cloud-aws)) | devDependencies | minor | `4.0.2` → `4.2.0` |  |  | | [io.micrometer:micrometer-bom](https://redirect.github.com/micrometer-metrics/micrometer-commercial) | devDependencies | minor | `1.16.5` → `1.17.1` |  |  | | [org.slf4j:slf4j-bom](http://www.slf4j.org) ([source](https://redirect.github.com/qos-ch/slf4j), [changelog](https://www.slf4j.org/news.html)) | devDependencies | patch | `2.0.17` → `2.0.20` |  |  | | io.qameta.allure | plugin | minor | `4.1.0` → `4.3.0` |  |  | --- ### Release Notes <details> <summary>actions/download-artifact</summary> ### [`v8.0.2`](https://redirect.github.com/actions/download-artifact/releases/tag/v8.0.2) [Compare Source](https://redirect.github.com/actions/download-artifact/compare/v8.0.1...v8.0.2) #### What's Changed - Update the readme by [@​danwkennedy](https://redirect.github.com/danwkennedy) in [#​473](https://redirect.github.com/actions/download-artifact/pull/473) - Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers. - Update [@​actions/artifact](https://redirect.github.com/actions/artifact) to 6.3.1 by [@​tunc-d](https://redirect.github.com/tunc-d) in [#​492](https://redirect.github.com/actions/download-artifact/pull/492) - Prepare download-artifact v8.0.2 by [@​tunc-d](https://redirect.github.com/tunc-d) in [#​493](https://redirect.github.com/actions/download-artifact/pull/493) #### New Contributors - [@​tunc-d](https://redirect.github.com/tunc-d) made their first contribution in [#​492](https://redirect.github.com/actions/download-artifact/pull/492) **Full Changelog**: <https://github.com/actions/download-artifact/compare/v8.0.1...v8.0.2> </details> <details> <summary>actions/setup-java</summary> ### [`v6.1.0`](https://redirect.github.com/actions/setup-java/releases/tag/v6.1.0) [Compare Source](https://redirect.github.com/actions/setup-java/compare/v6.0.1...v6.1.0) #### What's Changed - Preserve compound Liberica build versions from .sdkmanrc by [@​brunoborges](https://redirect.github.com/brunoborges) with [@​Copilot](https://redirect.github.com/Copilot) in [#​1268](https://redirect.github.com/actions/setup-java/pull/1268) - Support Temurin on Linux RISC-V by [@​yawkat](https://redirect.github.com/yawkat) in [#​1269](https://redirect.github.com/actions/setup-java/pull/1269) - Stop GPG agent before removing signature-verification home by [@​brunoborges](https://redirect.github.com/brunoborges) with [@​Copilot](https://redirect.github.com/Copilot) in [#​1273](https://redirect.github.com/actions/setup-java/pull/1273) - Prefer Zulu 4-segment hotfix builds when resolving version ranges by [@​brunoborges](https://redirect.github.com/brunoborges) in [#​1278](https://redirect.github.com/actions/setup-java/pull/1278) - Support Temurin JEP 322 patch versions like 26.0.2.1+1 by [@​brunoborges](https://redirect.github.com/brunoborges) in [#​1279](https://redirect.github.com/actions/setup-java/pull/1279) - chore(deps): bump undici from 6.28.0 to 6.29.0 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​1274](https://redirect.github.com/actions/setup-java/pull/1274) - chore(deps): bump the monthly-npm-updates group with 13 updates by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​1276](https://redirect.github.com/actions/setup-java/pull/1276) - feat: support Maven server credential origins by [@​YunaBraska](https://redirect.github.com/YunaBraska) in [#​1282](https://redirect.github.com/actions/setup-java/pull/1282) - Support Maven plugin repositories in generated settings.xml by [@​brunoborges](https://redirect.github.com/brunoborges) in [#​1286](https://redirect.github.com/actions/setup-java/pull/1286) #### New Contributors - [@​yawkat](https://redirect.github.com/yawkat) made their first contribution in [#​1269](https://redirect.github.com/actions/setup-java/pull/1269) - [@​YunaBraska](https://redirect.github.com/YunaBraska) made their first contribution in [#​1282](https://redirect.github.com/actions/setup-java/pull/1282) **Full Changelog**: <https://github.com/actions/setup-java/compare/v6.0.1...v6.1.0> </details> <details> <summary>apache/kafka</summary> ### [`v4.3.1`](https://redirect.github.com/apache/kafka/compare/4.3.0...4.3.1) [Compare Source](https://redirect.github.com/apache/kafka/compare/4.3.0...4.3.1) ### [`v4.3.0`](https://redirect.github.com/apache/kafka/compare/4.2.2...4.3.0) [Compare Source](https://redirect.github.com/apache/kafka/compare/4.2.0...4.3.0) </details> <details> <summary>gradle/gradle (gradle)</summary> ### [`v9.8.1`](https://redirect.github.com/gradle/gradle/releases/tag/v9.8.1): 9.8.1 [Compare Source](https://redirect.github.com/gradle/gradle/compare/v9.8.0...v9.8.1) This is a patch release for Gradle 9.8.0. We recommend using 9.8.1 instead of 9.8.0. This release addresses three high rated vulnerabilities: - [Unauthenticated worker-to-daemon channel deserializes untrusted Java objects](https://redirect.github.com/gradle/gradle/security/advisories/GHSA-mvvg-497x-hmj8) - [Deserialization of untrusted Java objects before authentication in the client - daemon communication](https://redirect.github.com/gradle/gradle/security/advisories/GHSA-xwqc-3h47-hg64) - [Failure to disable repositories failing to establish an SSL connection can expose builds to malicious artifacts](https://redirect.github.com/gradle/gradle/security/advisories/GHSA-j5m7-59rp-24f5) The following issues were resolved: - \[Gradle 9.8.0 complains again about invalid Toolchains on Debian / Ubuntu packaged systems]- ([#​39358](https://redirect.github.com/gradle/gradle/issues/39358)) - [Gradle 9.8.0 removes root java.util.logging handlers installed by a custom LogManager (breaks Quarkus test log capture)](https://redirect.github.com/gradle/gradle/issues/39359) - [Dependency resolution regression](https://redirect.github.com/gradle/gradle/issues/39365) [Read the Release Notes](https://docs.gradle.org/9.8.1/release-notes.html) We would like to thank the following community members for their contributions to this release of Gradle: [Aman Gautam](https://redirect.github.com/Gautam-aman), [Björn Kautler](https://redirect.github.com/Vampire), [Eng Zer Jun](https://redirect.github.com/Juneezee), [Hashim Khan](https://redirect.github.com/Hashim1999164), [Julian Krannich](https://redirect.github.com/jkrannich), [KBS](https://redirect.github.com/youdie006), [Labh R Jethe](https://redirect.github.com/itsCodeTide), [Mark Dodgson](https://redirect.github.com/doddi), [Maxim](https://redirect.github.com/kroune), [monkey](https://redirect.github.com/Develop-KIM), [nataphon-ktsystems](https://redirect.github.com/nataphon-ktsystems), [Paul King](https://redirect.github.com/paulk-asert), [Qiu Tian](https://redirect.github.com/qiu-tiandev), [rg_sandesh](https://redirect.github.com/sandeshgorde), [Roberto Perez Alcolea](https://redirect.github.com/rpalcolea), [Sean](https://redirect.github.com/seanxuu), [Zongle Wang](https://redirect.github.com/Goooler). #### Upgrade instructions Switch your build to use Gradle 9.8.1 by updating your wrapper: ``` ./gradlew :wrapper --gradle-version=9.8.1 && ./gradlew :wrapper ``` See the Gradle [9.x upgrade guide](https://docs.gradle.org/9.8.1/userguide/upgrading_version_9.html) to learn about deprecations, breaking changes and other considerations when upgrading. For Java, Groovy, Kotlin and Android compatibility, see the [full compatibility notes](https://docs.gradle.org/9.8.1/userguide/compatibility.html). #### Reporting problems If you find a problem with this release, please file a bug on [GitHub Issues](https://redirect.github.com/gradle/gradle/issues) adhering to our issue guidelines. If you're not sure you're encountering a bug, please use the [forum](https://discuss.gradle.org/c/help-discuss). We hope you will build happiness with Gradle, and we look forward to your feedback via [Twitter](https://twitter.com/gradle) or on [GitHub](https://redirect.github.com/gradle). ### [`v9.8.0`](https://redirect.github.com/gradle/gradle/releases/tag/v9.8.0): 9.8.0 [Compare Source](https://redirect.github.com/gradle/gradle/compare/v9.7.1...v9.8.0) The Gradle team is excited to announce Gradle 9.8.0. Here are the highlights of this release: - Java 27 support - Maven mirror settings reuse - Linked problem locations in build output [Read the Release Notes](https://docs.gradle.org/9.8.0/release-notes.html) We would like to thank the following community members for their contributions to this release of Gradle: [Aman Gautam](https://redirect.github.com/Gautam-aman), [Björn Kautler](https://redirect.github.com/Vampire), [Eng Zer Jun](https://redirect.github.com/Juneezee), [Hashim Khan](https://redirect.github.com/Hashim1999164), [Julian Krannich](https://redirect.github.com/jkrannich), [KBS](https://redirect.github.com/youdie006), [Labh R Jethe](https://redirect.github.com/itsCodeTide), [Mark Dodgson](https://redirect.github.com/doddi), [Maxim](https://redirect.github.com/kroune), [monkey](https://redirect.github.com/Develop-KIM), [nataphon-ktsystems](https://redirect.github.com/nataphon-ktsystems), [Paul King](https://redirect.github.com/paulk-asert), [Qiu Tian](https://redirect.github.com/qiu-tiandev), [rg_sandesh](https://redirect.github.com/sandeshgorde), [Roberto Perez Alcolea](https://redirect.github.com/rpalcolea), [Sean](https://redirect.github.com/seanxuu), [Zongle Wang](https://redirect.github.com/Goooler). #### Upgrade instructions Switch your build to use Gradle 9.8.0 by updating your wrapper: ``` ./gradlew :wrapper --gradle-version=9.8.0 && ./gradlew :wrapper ``` See the Gradle [9.x upgrade guide](https://docs.gradle.org/9.8.0/userguide/upgrading_version_9.html) to learn about deprecations, breaking changes and other considerations when upgrading. For Java, Groovy, Kotlin and Android compatibility, see the [full compatibility notes](https://docs.gradle.org/9.8.0/userguide/compatibility.html). #### Reporting problems If you find a problem with this release, please file a bug on [GitHub Issues](https://redirect.github.com/gradle/gradle/issues) adhering to our issue guidelines. If you're not sure you're encountering a bug, please use the [forum](https://discuss.gradle.org/c/help-discuss). We hope you will build happiness with Gradle, and we look forward to your feedback via [Twitter](https://twitter.com/gradle) or on [GitHub](https://redirect.github.com/gradle). </details> <details> <summary>gradle/actions</summary> ### [`v6.4.0`](https://redirect.github.com/gradle/actions/releases/tag/v6.4.0) [Compare Source](https://redirect.github.com/gradle/actions/compare/v6.3.0...v6.4.0) #### Highlights ##### Gradle version support status in the Job Summary The actions now report the support status of every Gradle version used in a workflow, as job annotations and in the Job Summary ([#​1057](https://redirect.github.com/gradle/actions/issues/1057)). Thanks to [@​ov7a](https://redirect.github.com/ov7a) for the contribution. | version kind | job annotation | version table | below the table | | --------------------------------------------------------------------------------------- | -------------- | -------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- | | **End-of-life** — two or more major versions behind the latest release | warning | :warning: | expandable section naming the affected release lines, pointing at the [Gradle Security Subscription](https://gradle.org/security-subscription/) | | **Out of date** — one major behind, or more than two minors behind on the current major | notice | :information_source: | one-line legend pointing at the [Gradle release lifecycle](https://docs.gradle.org/current/userguide/feature_lifecycle.html#eol_support) docs | | **Current** | none | — | — | Deliberately *not* reported: patch releases (being on `9.7.0` when `9.7.1` exists is not flagged) and pre-releases (release candidates, milestones and snapshots never produce annotations). The latest Gradle release is determined from the wrapper checksum data already bundled with the action, so no network access is required. Note that these annotations are emitted independently of the `add-job-summary` setting: setting `add-job-summary: 'never'` suppresses the Job Summary itself, but the warning and notice annotations remain. ##### Gradle itself is now reported in the dependency graph The `dependency-submission` action now applies **v1.5.0** of the [GitHub Dependency Graph Gradle Plugin](https://redirect.github.com/gradle/github-dependency-graph-gradle-plugin) (up from v1.4.2) ([#​1069](https://redirect.github.com/gradle/actions/issues/1069)). The headline change is that the Gradle Build Tool running the build is now reported as an `org.gradle:gradle-core` dependency, so that **GitHub can surface known vulnerabilities in the version of Gradle used to run your build**. These are the coordinates that GitHub advisories for the Gradle Build Tool are published against. Details worth knowing: - The entry is always reported as a **direct** dependency with **development** scope. - It is **not** affected by the project, configuration or scope filters, so it appears even in graphs that filter aggressively. - Expect dependency graphs to gain this one new entry the first time a build runs after upgrading. ##### A new Gradle signing key, if you use dependency verification > \[!IMPORTANT] > If your build has [dependency verification](https://docs.gradle.org/current/userguide/dependency_verification.html#sec:signature-verification) > enabled, you must add a **second** trusted key before upgrading, or Dependency Graph generation will > fail signature verification. `github-dependency-graph-gradle-plugin` `1.5.0` is signed with a new Gradle signing subkey, and the key previously documented in our setup guide has been revoked upstream: | Artifact | Signing key | | -------------------------------------------------------------------- | --------------------------------------------------------- | | `org.gradle:github-dependency-graph-gradle-plugin` `1.5.0` and later | `E2879931BCA1A42E55F2D64DD9B2DFBD9F3298BA` (new) | | `org.gradle` plugin versions before the rotation | `7B79ADD11F8A779FE90FD3D0893A028475557671` (old, revoked) | | `com.gradle` Develocity Gradle plugin, including `4.5.0` | `7B79ADD11F8A779FE90FD3D0893A028475557671` (old, revoked) | Because the Develocity Gradle plugin is still signed with the old key, you should trust **both** keys rather than swapping one for the other — replacing the old key outright will break Develocity injection. The documented snippet in [docs/setup-gradle.md](https://redirect.github.com/gradle/actions/blob/3f5f9adaf7d9fecd50b5935e54106014257a94e6/docs/setup-gradle.md#dependency-verification) has been updated accordingly ([#​1071](https://redirect.github.com/gradle/actions/issues/1071)): ```xml <trusted-keys> <trusted-key id="7B79ADD11F8A779FE90FD3D0893A028475557671"> <trusting group="com.gradle"/> <trusting group="org.gradle"/> </trusted-key> <trusted-key id="E2879931BCA1A42E55F2D64DD9B2DFBD9F3298BA"> <trusting group="org.gradle"/> </trusted-key> </trusted-keys> ``` ##### `cache-provider: external` for externally managed Gradle User Home Builds that save and restore Gradle User Home by some other mechanism (Develocity Artifact Cache, for example) previously had to set `cache-disabled: true`, which was misleading: caching wasn't disabled, it just wasn't managed by this action, and the Job Summary reported it as "Disabled". `cache-provider: external` skips Gradle User Home restore/save exactly as `cache-disabled` does, but reports a distinct **External** status in the Job Summary explaining that caching is handled by another provider ([#​1059](https://redirect.github.com/gradle/actions/issues/1059)). ```yaml - uses: gradle/actions/setup-gradle@v6 with: cache-provider: 'external' ``` ##### Develocity access keys containing OIDC tokens now work Short-lived-token handling validated the `server=key[;server=key]*` access key format with a regex whose `key` portion was too strict, so an access key holding an OIDC token value was rejected outright. Worse, had it passed the regex, parsing split each entry on `=` and kept only the second field — silently **truncating** any key containing `=` (as JWT padding does) and sending the mangled key to the server. Both problems are fixed ([#​1061](https://redirect.github.com/gradle/actions/issues/1061)). ##### Job Summary attribution Job summaries produced by `setup-gradle` and `dependency-submission` now carry a top-level heading naming the action, so the block stays attributable when another action's summary content lands in the same job ([#​1058](https://redirect.github.com/gradle/actions/issues/1058)). ##### Updated defaults - GitHub Dependency Graph Gradle Plugin: **1.4.2 → 1.5.0** - 5 new known-good wrapper checksums for `wrapper-validation` (368 → 373 entries) #### What's Changed - Bump the github-actions group across 3 directories with 6 updates by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​1039](https://redirect.github.com/gradle/actions/pull/1039) - Bump the npm-dependencies group in /sources with 3 updates by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​1038](https://redirect.github.com/gradle/actions/pull/1038) - Add action heading to Gradle job summary by [@​bigdaz](https://redirect.github.com/bigdaz) in [#​1058](https://redirect.github.com/gradle/actions/pull/1058) - Add cache-provider: external to skip Gradle User Home caching by [@​bigdaz](https://redirect.github.com/bigdaz) in [#​1059](https://redirect.github.com/gradle/actions/pull/1059) - Relax Develocity access key format validation by [@​bigdaz](https://redirect.github.com/bigdaz) in [#​1061](https://redirect.github.com/gradle/actions/pull/1061) - Use the root-qualified `:wrapper` task by [@​cobexer](https://redirect.github.com/cobexer) in [#​1064](https://redirect.github.com/gradle/actions/pull/1064) - Report EOL and maintenance status for Gradle versions by [@​ov7a](https://redirect.github.com/ov7a) in [#​1057](https://redirect.github.com/gradle/actions/pull/1057) - Update dependencies by [@​bigdaz](https://redirect.github.com/bigdaz) in [#​1065](https://redirect.github.com/gradle/actions/pull/1065) - Update .tool-versions: node 24.18.0, gradle 9.7.1, java 17 by [@​bigdaz](https://redirect.github.com/bigdaz) in [#​1068](https://redirect.github.com/gradle/actions/pull/1068) - Combined automated updates: wrapper checksums, npm dependencies, setup-java by [@​bigdaz](https://redirect.github.com/bigdaz) in [#​1070](https://redirect.github.com/gradle/actions/pull/1070) - Bump dependency-graph-gradle-plugin to 1.5.0 by [@​bigdaz](https://redirect.github.com/bigdaz) in [#​1069](https://redirect.github.com/grad > [!IMPORTANT] > ✂ PR body was truncated to here. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/apache/fineract). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNjQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoiZGV2ZWxvcCIsImxhYmVscyI6WyJyZW5vdmF0ZSJdfQ==--> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
