Release version 9.4.3

.github/workflows/build.yml

@@ -14,10 +14,10 @@ jobs:
       matrix:
         os: [ ubuntu-24.04-arm, windows-latest ]
         # Test on the minimum Gradle version and the latest.
-        gradle: [ 9.0.0, current ]
+        gradle: [ 9.1.0, current ]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-java@v5
         with:
           distribution: 'zulu'
@@ -46,7 +46,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     if: github.event.repository.fork == false && github.ref == 'refs/heads/main'
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-java@v5
         with:
           distribution: 'zulu'

.github/workflows/deploy.yml

@@ -14,7 +14,7 @@ jobs:
       id-token: write
       pages: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: gradle/actions/setup-gradle@v6
         with:
           cache-read-only: true
@@ -25,7 +25,7 @@ jobs:
           # Don't cache it to track updates.
           pip install mkdocs-material
           mkdocs build
-      - uses: actions/upload-pages-artifact@v4
+      - uses: actions/upload-pages-artifact@v5
         with:
           path: site
       - uses: actions/deploy-pages@v5

.github/workflows/links.yml

@@ -19,10 +19,10 @@ on:
 
 jobs:
   check-links:
-    runs-on: ubuntu-latest # TODO: https://github.com/UmbrellaDocs/linkspector/issues/149
+    runs-on: ubuntu-24.04-arm
     if: github.event.repository.fork == false
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: gradle/actions/setup-gradle@v6
         with:
           cache-read-only: true

.github/workflows/release.yml

@@ -14,7 +14,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: actions/setup-java@v5
         with:
           distribution: 'zulu'

build.gradle.kts

@@ -29,7 +29,7 @@ dokka { dokkaPublications.html { outputDirectory = rootDir.resolve("docs/api") }
 
 kotlin {
   explicitApi()
-  @OptIn(ExperimentalAbiValidation::class) abiValidation { enabled = true }
+  @OptIn(ExperimentalAbiValidation::class) abiValidation()
   val jdkRelease = "17"
   compilerOptions {
     allWarningsAsErrors = true
@@ -60,13 +60,15 @@ spotless {
   kotlinGradle { ktfmt(libs.ktfmt.get().version).googleStyle() }
 }
 
-val testPluginClasspath by configurations.registering {
-  isCanBeResolved = true
-  description = "Plugins used in integration tests could be resolved in classpath."
-}
+val testPluginClasspath =
+  configurations.register("testPluginClasspath") {
+    isCanBeResolved = true
+    description = "Plugins used in integration tests could be resolved in classpath."
+    extendsFrom(configurations.compileOnly)
+  }
 
-val testKit by sourceSets.creating
-val testKitImplementation by configurations.getting
+val testKit = sourceSets.register("testKit")
+val testKitImplementation = configurations.named("testKitImplementation")
 
 configurations.configureEach {
   when (name) {
@@ -129,8 +131,6 @@ dependencies {
   testKitImplementation(libs.assertk)
 
   testPluginClasspath(libs.foojayResolver)
-  testPluginClasspath(libs.develocity)
-  testPluginClasspath(libs.kotlin.gradlePlugin)
   testPluginClasspath(libs.pluginPublish)
 
   lintChecks(libs.androidx.gradlePluginLints)
@@ -178,7 +178,7 @@ testing.suites {
   withType<JvmTestSuite>().configureEach {
     useJUnitJupiter(libs.junit.bom.map { checkNotNull(it.version) })
     dependencies {
-      implementation(testKit.output)
+      implementation(testKit.get().output)
       implementation(libs.assertk)
     }
     targets.configureEach {
@@ -214,7 +214,7 @@ gradlePlugin {
 
 // This part should be placed after testing.suites to ensure the test sourceSets are created.
 kotlin.target.compilations {
-  val main by getting
+  val main = getByName("main")
   getByName("functionalTest") {
     // Import main and its classpath as dependencies and establish internal visibility.
     associateWith(main)

docs/about/README.md

@@ -19,7 +19,7 @@ so Shadow was published there.
 ## Maintainers
 
 * [John Engelman](https://github.com/johnrengelman)
-* [Goooler](https://github.com/Goooler)
+* [Zongle Wang](https://github.com/Goooler)
 
 ## Contributors
 

docs/changes/README.md

@@ -1,6 +1,12 @@
 # Change Log
 
 
+## [9.4.3](https://github.com/GradleUp/shadow/releases/tag/9.4.3) - 2026-06-26
+
+### Changed
+
+- Update dependencies for resolving CVEs. ([#2069](https://github.com/GradleUp/shadow/pull/2069))
+
 ## [9.4.2](https://github.com/GradleUp/shadow/releases/tag/9.4.2) - 2026-05-28
 
 ### Changed
@@ -716,7 +722,7 @@ type.
   ```
 
 - [Cédric Champeau](https://github.com/melix) - Support Gradle 7 [#624](https://github.com/GradleUp/shadow/pull/624)
-- [Daniel Oakey](https://github.com/danieloakey) - Close `FileInputStream` when remapping close to avoid classloader
+- [Daniel Oakey](https://github.com/ghost) - Close `FileInputStream` when remapping close to avoid classloader
   locks [#642](https://github.com/GradleUp/shadow/pull/642)
 - [Maximilian Müller](https://github.com/maxm123) - Groovy error in `ServiceFileTransformer` in Gradle
   3 [#655](https://github.com/GradleUp/shadow/pull/655)

docs/configuration/README.md

@@ -126,7 +126,7 @@ configure the upstream.
 === "Kotlin"
 
     ```kotlin
-    val testJar by tasks.registering(Jar::class) {
+    val testJar = tasks.register<Jar>("testJar") {
       manifest {
         attributes["Description"] = "This is an application JAR"
       }

docs/configuration/dependencies/README.md

@@ -123,7 +123,7 @@ configuration.
 === "Kotlin"
 
     ```kotlin
-    val nonJar by configurations.creating
+    val nonJar = configurations.create("nonJar")
 
     // This is necessary to make the dependencies in `nonJar` available at compile time.
     // If you don't need that, you can skip this step.

docs/configuration/merging/README.md

@@ -582,13 +582,46 @@ You can use `include`/`exclude` and more methods to configure the patterns for t
     }
     ```
 
+## Finding Resources in the Classpath
+
+When dealing with resource merge conflicts, it can be helpful to find which dependencies contain the conflicting resources.
+Shadow provides a [`FindResourceInClasspath`][FindResourceInClasspath] helper task for this purpose.
+
+To scan for resources, register a [`FindResourceInClasspath`][FindResourceInClasspath] task in your build script and configure its `classpath` and the resource patterns to look for:
+
+=== "Kotlin"
+
+    ```kotlin
+    tasks.register<com.github.jengelman.gradle.plugins.shadow.tasks.FindResourceInClasspath>("findResources") {
+      classpath.from(configurations.runtimeClasspath)
+      include("META-INF/services/org.codehaus.groovy.runtime.ExtensionModule")
+    }
+    ```
+
+=== "Groovy"
+
+    ```groovy
+    tasks.register('findResources', com.github.jengelman.gradle.plugins.shadow.tasks.FindResourceInClasspath) {
+      classpath.from(configurations.runtimeClasspath)
+      include 'META-INF/services/org.codehaus.groovy.runtime.ExtensionModule'
+    }
+    ```
+
+You can then run the task to scan each entry on the classpath and print any matched resources to the console:
+
+```shell
+./gradlew findResources
+```
+
+
 
 [AbstractCopyTask]: https://docs.gradle.org/current/dsl/org.gradle.api.tasks.AbstractCopyTask.html
 [Jar.eachFile]: https://docs.gradle.org/current/dsl/org.gradle.jvm.tasks.Jar.html#org.gradle.jvm.tasks.Jar:eachFile(org.gradle.api.Action)
 [Jar.filesMatching]: https://docs.gradle.org/current/dsl/org.gradle.jvm.tasks.Jar.html#org.gradle.jvm.tasks.Jar:filesMatching(java.lang.Iterable,%20org.gradle.api.Action)
 [Jar.filesNotMatching]: https://docs.gradle.org/current/dsl/org.gradle.jvm.tasks.Jar.html#org.gradle.jvm.tasks.Jar:filesNotMatching(java.lang.Iterable,%20org.gradle.api.Action)
 [AppendingTransformer]: ../../api/shadow/com.github.jengelman.gradle.plugins.shadow.transformers/-appending-transformer/index.html
 [DuplicatesStrategy]: https://docs.gradle.org/current/javadoc/org/gradle/api/file/DuplicatesStrategy.html
+[FindResourceInClasspath]: ../../api/shadow/com.github.jengelman.gradle.plugins.shadow.tasks/-find-resource-in-classpath/index.html
 [GroovyExtensionModuleTransformer]: ../../api/shadow/com.github.jengelman.gradle.plugins.shadow.transformers/-groovy-extension-module-transformer/index.html
 [Jar]: https://docs.gradle.org/current/dsl/org.gradle.api.tasks.bundling.Jar.html
 [Log4j2PluginsCacheFileTransformer]: ../../api/shadow/com.github.jengelman.gradle.plugins.shadow.transformers/-log4j2-plugins-cache-file-transformer/index.html

docs/custom-tasks/README.md

@@ -8,7 +8,7 @@ the output.
 === "Kotlin"
 
     ```kotlin
-    val testShadowJar by tasks.registering(com.github.jengelman.gradle.plugins.shadow.tasks.ShadowJar::class) {
+    val testShadowJar = tasks.register<com.github.jengelman.gradle.plugins.shadow.tasks.ShadowJar>("testShadowJar") {
       description = "Create a combined JAR of project and test dependencies"
 
       archiveClassifier = "test"
@@ -64,7 +64,7 @@ source code. This is accomplished by creating a custom [`ShadowJar`][ShadowJar]
 === "Kotlin"
 
     ```kotlin
-    tasks.registering(com.github.jengelman.gradle.plugins.shadow.tasks.ShadowJar::class) {
+    val dependencyShadowJar = tasks.register<com.github.jengelman.gradle.plugins.shadow.tasks.ShadowJar>("dependencyShadowJar") {
       description = "Create a shadow JAR of all dependencies"
       archiveClassifier = "dep"
       configurations = project.configurations.runtimeClasspath.map { listOf(it) }

docs/kotlin-plugins/README.md

@@ -80,18 +80,17 @@ automatically configure additional tasks for bundling the shadowed JAR for its `
     val ktorVersion = "3.1.0"
 
     kotlin {
-      @Suppress("OPT_IN_USAGE")
       jvm().mainRun {
         // Optionally, set the main class for `runJvm`.
         mainClass = "myapp.MainKt"
       }
       sourceSets {
-        val commonMain by getting {
+        commonMain {
           dependencies {
             implementation("io.ktor:ktor-client-core:$ktorVersion")
           }
         }
-        val jvmMain by getting {
+        jvmMain {
           dependencies {
             implementation("io.ktor:ktor-client-okhttp:$ktorVersion")
           }

docs/publishing/README.md

@@ -398,7 +398,7 @@ It is possible to publish a custom [`ShadowJar`][ShadowJar] task's output via th
       id("com.gradleup.shadow")
     }
 
-    val testShadowJar by tasks.registering(com.github.jengelman.gradle.plugins.shadow.tasks.ShadowJar::class) {
+    val testShadowJar = tasks.register<com.github.jengelman.gradle.plugins.shadow.tasks.ShadowJar>("testShadowJar") {
       description = "Create a combined JAR of project and test dependencies"
       archiveClassifier = "tests"
       from(sourceSets.test.map { it.output })

gradle.properties

@@ -7,9 +7,7 @@ org.gradle.configuration-cache=true
 org.gradle.configuration-cache.parallel=true
 org.gradle.jvmargs=-Dfile.encoding=UTF-8 -Xmx4g
 org.gradle.kotlin.dsl.allWarningsAsErrors=true
-org.gradle.parallel=true
 org.gradle.tooling.parallel=true
-org.gradle.unsafe.isolated-projects=true
 
 ########## Properties for publishing to Maven Central ##########
 
@@ -20,7 +18,7 @@ signAllPublications=true
 
 GROUP=com.gradleup.shadow
 POM_ARTIFACT_ID=shadow-gradle-plugin
-VERSION_NAME=9.4.2
+VERSION_NAME=9.4.3
 
 POM_NAME=Shadow Gradle Plugin
 POM_DESCRIPTION=Gradle plugin to create fat/uber JARs, apply file transforms, and relocate packages for applications and libraries. Gradle version of Maven's Shade plugin.

gradle/libs.versions.toml

@@ -1,41 +1,41 @@
 [versions]
 minGradle = "9.0.0"
-kotlin = "2.3.20"
+kotlin = "2.4.0"
 moshi = "1.15.2"
 pluginPublish = "2.1.1"
 
 [libraries]
-apache-ant = "org.apache.ant:ant:1.10.15"
-apache-commonsCodec = "commons-codec:commons-codec:1.21.0"
-apache-commonsIo = "commons-io:commons-io:2.21.0"
-apache-log4j = "org.apache.logging.log4j:log4j-core:2.25.3"
-apache-maven-model = "org.apache.maven:maven-model:3.9.14"
+apache-ant = "org.apache.ant:ant:1.10.17"
+apache-commonsCodec = "commons-codec:commons-codec:1.22.0"
+apache-commonsIo = "commons-io:commons-io:2.22.0"
+apache-log4j = "org.apache.logging.log4j:log4j-core:2.26.0"
+apache-maven-model = "org.apache.maven:maven-model:3.9.16"
 jdependency = "org.vafer:jdependency:2.16"
 jdom2 = "org.jdom:jdom2:2.0.6.1"
 kotlin-metadata = { module = "org.jetbrains.kotlin:kotlin-metadata-jvm", version.ref = "kotlin" }
 kotlin-reflect = { module = "org.jetbrains.kotlin:kotlin-reflect", version.ref = "kotlin" }
-plexus-utils = "org.codehaus.plexus:plexus-utils:4.0.2"
+plexus-utils = "org.codehaus.plexus:plexus-utils:4.0.3"
 plexus-xml = "org.codehaus.plexus:plexus-xml:4.1.1"
-xmlunit = "org.xmlunit:xmlunit-legacy:2.11.0"
+xmlunit = "org.xmlunit:xmlunit-legacy:2.12.0"
 moshi = { module = "com.squareup.moshi:moshi", version.ref = "moshi" }
 moshi-kotlin = { module = "com.squareup.moshi:moshi-kotlin", version.ref = "moshi" }
 
 foojayResolver = "org.gradle.toolchains.foojay-resolver-convention:org.gradle.toolchains.foojay-resolver-convention.gradle.plugin:1.0.0"
-develocity = "com.gradle:develocity-gradle-plugin:4.4.0"
+develocity = "com.gradle:develocity-gradle-plugin:4.4.3"
 kotlin-gradlePlugin = { module = "org.jetbrains.kotlin:kotlin-gradle-plugin", version.ref = "kotlin" }
 pluginPublish = { module = "com.gradle.publish:plugin-publish-plugin", version.ref = "pluginPublish" }
 
-androidx-gradlePluginLints = "androidx.lint:lint-gradle:1.0.0-alpha05"
+androidx-gradlePluginLints = "androidx.lint:lint-gradle:1.0.0"
 # Dummy to get renovate updates, the version is used in rootProject build.gradle with spotless.
-ktfmt = "com.facebook:ktfmt:0.62"
+ktfmt = "com.facebook:ktfmt:0.64"
 
-junit-bom = "org.junit:junit-bom:6.0.3"
+junit-bom = "org.junit:junit-bom:6.1.0"
 assertk = "com.willowtreeapps.assertk:assertk:0.28.1"
 
 [plugins]
 kotlin-jvm = { id = "org.jetbrains.kotlin.jvm", version.ref = "kotlin" }
-android-lint = "com.android.lint:9.1.0"
+android-lint = "com.android.lint:9.2.1"
 jetbrains-dokka = "org.jetbrains.dokka:2.2.0"
-mavenPublish = "com.vanniktech.maven.publish:0.36.0"
+mavenPublish = "com.vanniktech.maven.publish:0.37.0"
 pluginPublish = { id = "com.gradle.plugin-publish", version.ref = "pluginPublish" }
-spotless = "com.diffplug.spotless:8.4.0"
+spotless = "com.diffplug.spotless:8.7.0"

gradle/wrapper/gradle-wrapper.properties

@@ -1,7 +1,9 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-9.4.1-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.6.0-bin.zip
 networkTimeout=10000
+retries=0
+retryBackOffMs=500
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists