Conversation
Goooler
commented
Aug 13, 2026
Goooler
commented
Member
- CHANGELOG's "Unreleased" section has been updated, if applicable.
Original commit on main: 0c2744f
Original commit on main: d73d94a
Original commit on main: 85ba389
Original commit on main: ff1809f
Original commit on main: 74651fb
Original commit on main: 0fc59cc
Original commit on main: 8b6090e
Original commit on main: 90b0b3e
Original commit on main: d634779
…pper to 9.7.0 - Introduce gradle/libs.versions.toml to manage dependencies and plugins. - Refactor build.gradle.kts and settings.gradle.kts to use Version Catalog aliases. - Upgrade Gradle Wrapper to version 9.7.0.
Original commit on main: c2cd2ce
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
Pull request overview
This PR merges the 8.x branch into main, bringing over a set of behavioral fixes (notably around ZIP writing safety, relocation/remapping correctness, and build caching inputs), along with dependency/build tooling updates and new/updated test coverage.
Changes:
- Add ZIP entry name validation and switch multiple archive-writers to use it; adjust related transformers and add tests for the new behavior.
- Improve relocation/remapping behavior (descriptor handling, skipStringConstants semantics, exclude pattern normalization) with additional tests.
- Update build tooling/dependency management (Gradle wrapper, version catalog, plugin versions) and deprecate/replace a few legacy APIs.
Reviewed changes
Copilot reviewed 30 out of 32 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| src/test/groovy/com/github/jengelman/gradle/plugins/shadow/TransformerSpec.groovy | Updates Groovy extension module path expectations for the merged descriptor. |
| src/test/groovy/com/github/jengelman/gradle/plugins/shadow/transformers/PropertiesFileTransformerSpec.groovy | Adds a test asserting a GradleException when keyTransformer is null. |
| src/test/groovy/com/github/jengelman/gradle/plugins/shadow/ShadowPluginSpec.groovy | Adds coverage for skipping non-existent dependency directories during shadowJar. |
| src/test/groovy/com/github/jengelman/gradle/plugins/shadow/relocation/SimpleRelocatorTest.groovy | Extends relocation exclusion tests for additional pattern edge cases. |
| src/test/groovy/com/github/jengelman/gradle/plugins/shadow/relocation/RelocatorRemapperSpec.groovy | New tests for descriptor mapping and per-relocator skipStringConstants behavior. |
| src/test/groovy/com/github/jengelman/gradle/plugins/shadow/internal/ZipEntryValidationSpec.groovy | New tests validating Zip Slip/path traversal rejection in ZIP entry names. |
| src/test/groovy/com/github/jengelman/gradle/plugins/shadow/internal/CleanPropertiesSpec.groovy | New tests for deterministic/sorted properties serialization without comments. |
| src/test/groovy/com/github/jengelman/gradle/plugins/shadow/internal/AbstractDependencyFilterSpec.groovy | New test covering dependency version matching with + in the version. |
| src/test/groovy/com/github/jengelman/gradle/plugins/shadow/ApplicationSpec.groovy | Updates toolchain resolver plugin version used in test setup. |
| src/main/groovy/com/github/jengelman/gradle/plugins/shadow/transformers/TransformerContext.groovy | Removes Groovy @Builder usage and introduces a deprecated legacy Builder API. |
| src/main/groovy/com/github/jengelman/gradle/plugins/shadow/transformers/ServiceFileTransformer.groovy | Uses ZipUtils for safer ZipEntry creation. |
| src/main/groovy/com/github/jengelman/gradle/plugins/shadow/transformers/PropertiesFileTransformer.groovy | Switches to CleanProperties-based deterministic output and uses GradleException for build-failure cases. |
| src/main/groovy/com/github/jengelman/gradle/plugins/shadow/transformers/GroovyExtensionModuleTransformer.groovy | Treats both legacy/modern inputs as transformable but always emits the modern descriptor path. |
| src/main/groovy/com/github/jengelman/gradle/plugins/shadow/transformers/ApacheNoticeResourceTransformer.groovy | Reworks NOTICE writing logic and introduces a fallback copyright capture. |
| src/main/groovy/com/github/jengelman/gradle/plugins/shadow/tasks/ShadowJar.java | Adds includes/excludes to task inputs for correctness and skips non-existent dependency files. |
| src/main/groovy/com/github/jengelman/gradle/plugins/shadow/tasks/ShadowCopyAction.groovy | Uses ZipUtils for entry creation and avoids rewriting class bytes for no-op relocations. |
| src/main/groovy/com/github/jengelman/gradle/plugins/shadow/tasks/InheritManifest.groovy | Deprecates InheritManifest in favor of Gradle’s standard Manifest API. |
| src/main/groovy/com/github/jengelman/gradle/plugins/shadow/tasks/DefaultInheritManifest.groovy | Suppresses deprecation warnings for the legacy manifest implementation. |
| src/main/groovy/com/github/jengelman/gradle/plugins/shadow/ShadowPlugin.groovy | Fails fast when applied with AGP (com.android.base) to avoid unsupported use. |
| src/main/groovy/com/github/jengelman/gradle/plugins/shadow/ShadowApplicationPlugin.groovy | Respects executableDir for install/start scripts layout and file mode setting. |
| src/main/groovy/com/github/jengelman/gradle/plugins/shadow/relocation/SimpleRelocator.groovy | Adjusts include/exclude normalization for file-like patterns (e.g., kotlin builtins). |
| src/main/groovy/com/github/jengelman/gradle/plugins/shadow/internal/ZipUtils.groovy | Introduces centralized ZIP entry validation helper. |
| src/main/groovy/com/github/jengelman/gradle/plugins/shadow/internal/CleanProperties.groovy | Changes properties ordering and adds a comment-stripping writer for deterministic output. |
| src/main/groovy/com/github/jengelman/gradle/plugins/shadow/internal/AbstractDependencyFilter.groovy | Improves dependency matching by allowing exact equality before regex matching. |
| src/main/groovy/com/github/jengelman/gradle/plugins/shadow/impl/RelocatorRemapper.groovy | Expands descriptor parsing and supports mapping lists of types; adjusts skipStringConstants semantics. |
| src/docs/changes/README.md | Updates Unreleased changelog entries for merged fixes/changes/deprecations. |
| settings.gradle.kts | Updates Develocity plugin version/config and enables stable configuration cache preview. |
| gradlew.bat | Reformats the Gradle wrapper batch script (content unchanged). |
| gradle/wrapper/gradle-wrapper.properties | Updates Gradle wrapper distribution URL to 9.7.0. |
| gradle/libs.versions.toml | Adds a version catalog for dependencies/plugins. |
| build.gradle.kts | Switches plugin/dependency declarations to use the new version catalog. |
| AGENTS.md | Adds agent-specific contribution guidance referencing CONTRIBUTING.md. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Member
Author
|
Don't land this for now. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.