Update all dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change	Age	Confidence
actions/setup-java	action	major	v5 → v6
actions/stale	action	major	v10 → v11
gradle (source)		minor	9.6.1 → 9.8.1
jlumbroso/free-disk-space	action	major	v1.3.1 → v2.0.0
com.github.bumptech.glide:glide	dependencies	patch	5.0.7 → 5.0.9
com.facebook.fresco:fresco	dependencies	minor	3.7.0 → 3.9.0
androidx.constraintlayout:constraintlayout (source)	dependencies	patch	2.2.1 → 2.2.2
androidx.work:work-runtime-ktx (source)	dependencies	minor	2.11.2 → 2.12.0
androidx.transition:transition-ktx (source)	dependencies	patch	1.7.0 → 1.7.2
androidx.fragment:fragment-ktx (source)	dependencies	minor	1.8.9 → 1.9.1
androidx.core:core-ktx (source)	dependencies	patch	1.19.0 → 1.19.1
com.google.protobuf:protobuf-kotlin (source)	dependencies	minor	4.35.1 → 4.36.2
com.google.protobuf:protobuf-java (source)	dependencies	minor	4.35.1 → 4.36.2
com.google.android.gms:play-services-nearby	dependencies	minor	19.3.0 → 19.5.1
org.tensorflow:tensorflow-lite-gpu-api (source)	dependencies	minor	2.16.1 → 2.17.0
androidx.compose.remote:remote-creation-compose (source)	dependencies	patch	1.0.0-alpha20 → 1.0.0-SNAPSHOT
androidx.compose.remote:remote-creation (source)	dependencies	patch	1.0.0-alpha20 → 1.0.0-SNAPSHOT
androidx.compose.remote:remote-core (source)	dependencies	patch	1.0.0-alpha20 → 1.0.0-SNAPSHOT
com.google.firebase:firebase-crashlytics-buildtools	dependencies	patch	3.0.7 → 3.0.8
com.google.protobuf:protoc (source)	dependencies	minor	4.35.1 → 4.36.2
org.tensorflow:tensorflow-lite-support (source)	dependencies	minor	0.4.4 → 0.5.0
org.tensorflow:tensorflow-lite-gpu (source)	dependencies	minor	2.16.1 → 2.17.0
org.tensorflow:tensorflow-lite (source)	dependencies	minor	2.16.1 → 2.17.0
androidx.glance:glance-material3 (source)	dependencies	patch	1.3.0-alpha02 → 1.3.0-SNAPSHOT
androidx.glance:glance-appwidget-preview (source)	dependencies	patch	1.3.0-alpha02 → 1.3.0-SNAPSHOT
androidx.glance:glance-preview (source)	dependencies	patch	1.3.0-alpha02 → 1.3.0-SNAPSHOT
androidx.glance:glance-appwidget (source)	dependencies	patch	1.3.0-alpha02 → 1.3.0-SNAPSHOT
com.github.bumptech.glide:compose	dependencies	patch	1.0.0-beta09 → 1.0.0-beta10
androidx.media3:media3-ui	dependencies	minor	1.10.1 → 1.11.1
androidx.media3:media3-transformer	dependencies	minor	1.10.1 → 1.11.1
androidx.media3:media3-exoplayer	dependencies	minor	1.10.1 → 1.11.1
androidx.media3:media3-effect	dependencies	minor	1.10.1 → 1.11.1
androidx.media3:media3-common	dependencies	minor	1.10.1 → 1.11.1
androidx.camera:camera-extensions (source)	dependencies	patch	1.6.1 → 1.6.2
androidx.camera:camera-mlkit-vision (source)	dependencies	patch	1.6.1 → 1.6.2
androidx.camera:camera-view (source)	dependencies	patch	1.6.1 → 1.6.2
androidx.camera:camera-video (source)	dependencies	patch	1.6.1 → 1.6.2
androidx.camera:camera-lifecycle (source)	dependencies	patch	1.6.1 → 1.6.2
androidx.camera:camera-camera2 (source)	dependencies	patch	1.6.1 → 1.6.2
androidx.camera:camera-compose (source)	dependencies	patch	1.6.1 → 1.6.2
androidx.camera:camera-core (source)	dependencies	patch	1.6.1 → 1.6.2
androidx.navigation:navigation-ui (source)	dependencies	minor	2.9.8 → 2.10.2
androidx.navigation:navigation-fragment (source)	dependencies	minor	2.9.8 → 2.10.2
androidx.navigation:navigation-compose (source)	dependencies	minor	2.9.8 → 2.10.2
androidx.appcompat:appcompat (source)	dependencies	minor	1.7.1 → 1.8.0
androidx.compose:compose-bom	dependencies	minor	2026.06.01 → 2026.09.00
org.jetbrains.kotlin.plugin.serialization (source)	plugin	patch	2.4.0 → 2.4.21
com.diffplug.spotless:spotless-plugin-gradle	dependencies	minor	8.8.0 → 8.10.4
org.jetbrains.kotlin.plugin.compose (source)	plugin	patch	2.4.0 → 2.4.21
org.jetbrains.kotlin.android (source)	plugin	patch	2.4.0 → 2.4.21
androidx.fragment:fragment-compose (source)	dependencies	minor	1.8.9 → 1.9.1
com.android.library (source)	plugin	minor	9.2.1 → 9.4.1
com.android.application (source)	plugin	minor	9.2.1 → 9.4.1

---

Release Notes

actions/setup-java (actions/setup-java)

v6.0.1

Compare Source

What's Changed

• Fix failing GitHub Actions job for temurin 17 by @​brunoborges with @​Copilot in #​1259
• Fix Temurin EA E2E signature verification by @​brunoborges with @​Copilot in #​1260
• Fix Alpine GPG verification failures and support multiple keys by @​brunoborges in #​1262
• Fix import-safe checks when scripts are run from a path with symlinks by @​otaconix in #​1265
• Avoid macOS GPG socket overflow on long runner paths by @​brunoborges with @​Copilot in #​1266
• Complete v6 release highlights in README by @​brunoborges in #​1254
• Group and slow routine Dependabot updates by @​brunoborges in #​1255
• chore(deps-dev): update eslint and globals by @​dependabot[bot] in #​1256

New Contributors

• @​otaconix made their first contribution in #​1265

Full Changelog: actions/setup-java@v6.0.0...v6.0.1

v6.0.0

Compare Source

What's Changed

• dist: Migrate from Zulu Discovery API to Azul Metadata API by @​jameswald in #​1010
• feat: add .mvn/extensions.xml to Maven cache key pattern by @​brunoborges with @​Copilot in #​1041
• Migrate to ESM and upgrade dependencies by @​priyagupta108 in #​1078
• Map Zulu x86 architecture to i686 for Azul Metadata API by @​brunoborges in #​1079
• Rename jdkFile input to jdk-file with deprecated alias by @​brunoborges in #​1083
• Infer distribution from asdf .tool-versions vendor prefix by @​brunoborges in #​1084
• Add Maven compiler problem matcher for javac diagnostics by @​brunoborges in #​1086
• feat: expose cache-primary-key output (#​597) by @​brunoborges in #​1088
• docs: clarify V6 ESM migration is not a user-facing breaking change by @​brunoborges in #​1090
• Support multi-field Java versions like 18.0.1.1 by @​brunoborges in #​1092
• docs: document seeding the Maven cache for plugin dependencies by @​brunoborges in #​1094
• docs: clarify Maven cache paths and key hash inputs by @​brunoborges in #​1096
• Support pinning java-version as "latest" by @​brunoborges in #​1093
• chore(deps-dev): bump eslint from 10.6.0 to 10.7.0 by @​dependabot[bot] in #​1101
• chore(deps-dev): bump eslint-plugin-n from 18.2.1 to 18.2.2 by @​dependabot[bot] in #​1103
• chore(deps-dev): bump prettier from 3.9.4 to 3.9.5 by @​dependabot[bot] in #​1105
• chore(deps): bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​1106
• chore(deps-dev): bump @​types/node from 26.1.0 to 26.1.1 by @​dependabot[bot] in #​1104
• dist: Cover Tencent Kona JDK 25 by @​johnshajiang in #​1108
• chore(deps-dev): bump typescript from 6.0.3 to 7.0.2 by @​dependabot[bot] in #​1102
• Preserve Maven toolchains across repeated setup-java runs (#​1099) by @​brunoborges in #​1111
• dist: Support Liberica NIK (#​878) by @​asm0dey in #​1112
• Fix template injection (zizmor alert #​118) in e2e-versions.yml by @​brunoborges with @​Copilot in #​1114
• Fix template injection in e2e-versions.yml (zizmor alert #​122) by @​brunoborges with @​Copilot in #​1120
• Disable persisted checkout credentials in e2e workflow by @​brunoborges with @​Copilot in #​1115
• feat: Update recommended configuration for GPG signing by @​wetneb in #​608
• Cache Maven and Gradle wrapper distributions separately from the dependency cache by @​brunoborges in #​1097
• Consolidate cache-dependency-path e2e workflow and add maven/sbt coverage by @​brunoborges in #​1124
• Use gpg.passphraseEnvName instead of the deprecated gpg.passphrase server by @​brunoborges in #​1123
• Extract repeated directory-check assertions into check-dir.sh helper by @​brunoborges in #​1127
• Consolidate duplicate jobs in e2e-versions workflow by @​brunoborges in #​1125
• Use YAML anchors to reduce boilerplate in e2e-versions workflow by @​brunoborges in #​1126
• Updated msft json for now by @​jmjaffe37 in #​1129
• Document missing action inputs in README by @​brunoborges in #​1130
• chore(deps): bump @​actions/cache to 6.2.0 by @​philip-gai in #​1128
• Add an option to disable Java problem matchers by @​brunoborges in #​1133
• docs: update setup-java examples by @​HarithaVattikuti in #​1131
• Clarify credential environment variable inputs by @​brunoborges in #​1134
• chore(deps-dev): bump @​typescript-eslint/eslint-plugin from 8.63.0 to 8.64.0 by @​dependabot[bot] in #​1135
• chore(deps): bump actions/setup-python from 6 to 7 by @​dependabot[bot] in #​1143
• chore(deps): bump fast-xml-parser from 5.9.3 to 5.10.1 by @​dependabot[bot] in #​1142
• chore(deps-dev): bump @​typescript-eslint/parser from 8.64.0 to 8.65.0 by @​dependabot[bot] in #​1138
• chore(deps-dev): bump lint-staged from 17.0.8 to 17.2.0 by @​dependabot[bot] in #​1136
• chore(deps-dev): bump typescript from 6.0.3 to 7.0.2 by @​dependabot[bot] in #​1137
• chore(deps): fix npm audited vulnerabilities by @​mhoffrog in #​1140
• Fix formatting issues in README.md by @​brunoborges in #​1144
• Remediate npm audit findings and rebuild distributions by @​brunoborges with @​Copilot in #​1145
• Set GRAALVM_HOME for GraalVM distributions by @​brunoborges with @​Copilot in #​1146
• Add force-download option for reproducible JDK builds by @​brunoborges with @​Copilot in #​1148
• Add OpenJDK distribution by @​brunoborges with @​Copilot in #​1147
• Support Temurin JDKs with JMOD files by @​brunoborges with @​Copilot in #​1149
• Document Java package compatibility by distribution by @​brunoborges in #​1152
• Fix caching when wrapper distributions are absent by @​brunoborges in #​1151
• Reject invalid boolean input values by @​brunoborges in #​1160
• Fail on mismatched Maven toolchain ID counts by @​brunoborges in #​1161
• Consolidate JDK metadata retry handling by @​brunoborges in #​1162
• Add direct setup orchestration tests by @​brunoborges in #​1163
• Harden java-package validation across distributions by @​brunoborges in #​1165
• Verify JDK downloads with vendor checksums by @​brunoborges in #​1167
• Reduce change-time Java E2E matrix by @​brunoborges in #​1170
• Add read-only mode for dependency caching by @​brunoborges in #​1169
• Test Temurin 25 on hosted runners by @​brunoborges in #​1172
• Restore dependency and wrapper caches concurrently by @​brunoborges in #​1174
• Add dependency cache path overrides by @​brunoborges in #​1175
• Centralize OS/architecture capability validation by @​brunoborges in #​1178
• Optimize Temurin tool-cache fast path with lazy loading by @​brunoborges in #​1179
• Optimize Maven configuration warm path by @​brunoborges in #​1182
• Fix macOS e2e workflow assertions by @​brunoborges in #​1184
• Remove legacy Adopt distributions in v6 by @​brunoborges with @​Copilot in #​1185
• chore(deps): bump actions/upload-artifact from 6 to 7 by @​dependabot[bot] in #​1190
• Reimagine setup-java README by @​brunoborges in #​1192
• Document deprecation of setup-java v1 through v4 by @​brunoborges in #​1198
• Update setup-java README action from v6 to v5 by @​brunoborges in #​1199
• Highlight major changes in setup-java v5 by @​brunoborges in #​1200
• Highlight major changes in setup-java v6 by @​brunoborges in #​1203
• chore(deps): bump brace-expansion from 5.0.8 to 5.0.9 by @​dependabot[bot] in #​1202
• Add conditional JDK caching by @​brunoborges in #​1201
• docs: fix README and advanced usage inconsistencies with actual behavior by @​brunoborges in #​1204
• Move the extracted JDK into the tool-cache instead of copying it by @​brunoborges in #​1206
• docs: drop benchmark numbers from the JDK caching section by @​brunoborges in #​1205
• docs: correct the mvn-toolchain-id default in README and action.yml by @​brunoborges in #​1207
• Cache resolved JDK releases to remove the vendor API from warm jobs by @​brunoborges in #​1208
• Report concrete versions for floating Oracle JDK downloads by @​jdubois in #​1213
• Import Maven signing keys into an isolated GPG home by @​jdubois in #​1214
• Reuse the tool cache for floating versions the resolution cache identified by @​brunoborges in #​1219
• Fix JetBrains Runtime release pagination by @​jdubois in #​1218
• Fix JDK resolution cache platform identity by @​jdubois in #​1210
• fix: select musl JDK artifacts on Alpine for Dragonwell, Corretto, Zulu and Liberica by @​brunoborges in #​1220
• Fix SapMachine early-access filtering by @​jdubois in #​1217
• Fix JetBrains GitHub token resolution by @​jdubois in #​1224
• Include gradle.properties in Gradle cache key by @​jdubois in #​1225
• Handle early dependency cache failures during Java setup by @​jdubois in #​1226
• Fix js-yaml audit vulnerability by @​brunoborges in #​1228
• Fix failing GitHub Actions job for graalvm 24-ea by @​brunoborges with @​Copilot in #​1227
• Update setup-java for Microsoft's Build of OpenJDK: now pointing task to CDN that is always up-to-date by @​jmjaffe37 in #​1236
• chore(deps-dev): bump globals from 17.8.0 to 17.9.0 by @​dependabot[bot] in #​1233
• chore(deps-dev): bump @​types/semver from 7.7.1 to 7.8.0 by @​dependabot[bot] in #​1229
• chore(deps-dev): bump lint-staged from 17.2.0 to 17.3.0 by @​dependabot[bot] in #​1231
• chore(deps-dev): bump @​typescript-eslint/eslint-plugin from 8.65.0 to 8.67.0 by @​dependabot[bot] in #​1232
• Test JDK 26 installation from SDKMAN by @​brunoborges in #​1238
• Add support for multiple Maven servers by @​brunoborges in #​1239
• Add Maven dependency-resolution repositories by @​brunoborges in #​1240
• Add Red Hat Build of OpenJDK support by @​brunoborges in #​1241
• Fix Oracle macOS E2E version check by @​brunoborges in #​1243
• ci: constrain cache e2e job modes by @​philip-gai in #​1244
• Expose contributing guide to GitHub by @​brunoborges in #​1245
• Set default signature verification for supported distributions by @​johnoliver in #​1246
• chore(deps): combine open Dependabot npm updates by @​brunoborges in #​1252
• Prepare documentation for v6 release by @​brunoborges in #​1253

New Contributors

• @​jameswald made their first contribution in #​1010
• @​asm0dey made their first contribution in #​1112
• @​wetneb made their first contribution in #​608
• @​philip-gai made their first contribution in #​1128

Full Changelog: actions/setup-java@v5.7.0...v6.0.0

actions/stale (actions/stale)

v11.0.0

Compare Source

What's Changed

Enhancement

• Migrate to ESM and update dependencies by @​chiranjib-swain in #​1350

Dependency Update

• Override brace-expansion to 5.0.8 to address 24 high-severity dependency vulnerabilities by @​dependabot in #​1351

Full Changelog: actions/stale@v10...v11.0.0

gradle/gradle (gradle)

v9.8.1: 9.8.1

Compare Source

This is a patch release for Gradle 9.8.0. We recommend using 9.8.1 instead of 9.8.0.

This release addresses three high rated vulnerabilities:

• Unauthenticated worker-to-daemon channel deserializes untrusted Java objects
• Deserialization of untrusted Java objects before authentication in the client - daemon communication
• Failure to disable repositories failing to establish an SSL connection can expose builds to malicious artifacts

The following issues were resolved:

• [Gradle 9.8.0 complains again about invalid Toolchains on Debian / Ubuntu packaged systems]- (#​39358)
• Gradle 9.8.0 removes root java.util.logging handlers installed by a custom LogManager (breaks Quarkus test log capture)
• Dependency resolution regression

Read the Release Notes

We would like to thank the following community members for their contributions to this release of Gradle:
Aman Gautam,
Björn Kautler,
Eng Zer Jun,
Hashim Khan,
Julian Krannich,
KBS,
Labh R Jethe,
Mark Dodgson,
Maxim,
monkey,
nataphon-ktsystems,
Paul King,
Qiu Tian,
rg_sandesh,
Roberto Perez Alcolea,
Sean,
Zongle Wang.

Upgrade instructions

Switch your build to use Gradle 9.8.1 by updating your wrapper:

./gradlew :wrapper --gradle-version=9.8.1 && ./gradlew :wrapper

See the Gradle 9.x upgrade guide to learn about deprecations, breaking changes and other considerations when upgrading.

For Java, Groovy, Kotlin and Android compatibility, see the full compatibility notes.

Reporting problems

If you find a problem with this release, please file a bug on GitHub Issues adhering to our issue guidelines.
If you're not sure you're encountering a bug, please use the forum.

We hope you will build happiness with Gradle, and we look forward to your feedback via Twitter or on GitHub.

v9.8.0: 9.8.0

Compare Source

The Gradle team is excited to announce Gradle 9.8.0.

Here are the highlights of this release:

• Java 27 support
• Maven mirror settings reuse
• Linked problem locations in build output

Read the Release Notes

We would like to thank the following community members for their contributions to this release of Gradle:
Aman Gautam,
Björn Kautler,
Eng Zer Jun,
Hashim Khan,
Julian Krannich,
KBS,
Labh R Jethe,
Mark Dodgson,
Maxim,
monkey,
nataphon-ktsystems,
Paul King,
Qiu Tian,
rg_sandesh,
Roberto Perez Alcolea,
Sean,
Zongle Wang.

Upgrade instructions

Switch your build to use Gradle 9.8.0 by updating your wrapper:

./gradlew :wrapper --gradle-version=9.8.0 && ./gradlew :wrapper

See the Gradle 9.x upgrade guide to learn about deprecations, breaking changes and other considerations when upgrading.

For Java, Groovy, Kotlin and Android compatibility, see the full compatibility notes.

Reporting problems

If you find a problem with this release, please file a bug on GitHub Issues adhering to our issue guidelines.
If you're not sure you're encountering a bug, please use the forum.

We hope you will build happiness with Gradle, and we look forward to your feedback via Twitter or on GitHub.

v9.7.1: 9.7.1

Compare Source

The Gradle team is excited to announce Gradle 9.7.1.

This is a patch release for 9.7.0. We recommend using 9.7.1 instead of 9.7.0.

Here are the highlights of 9.7.0 release:

• Isolated Projects graduates to incubating
• Broader Configuration Cache compatibility
• Resilient Sync helps you fix broken builds
• More source locations in problem reports

Read the Release Notes

We would like to thank the following community members for their contributions to this release of Gradle:
Adam,
Aman Gautam,
Aman Kumar,
[Anton Dubrouski](https://redirect.github.com/adubrous

❗ Important

✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.