Repository navigation
chore: bump gradle-wrapper in / - #964
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [gradle-wrapper](https://github.com/gradle/gradle) in `/` from 8.5 to 8.14.6. Updates `gradle-wrapper` from 8.5 to 8.14.6 - [Release notes](https://github.com/gradle/gradle/releases) - [Commits](gradle/gradle@v8.5.0...v8.14.6) Updates `gradle-wrapper` from 8.0.2 to 8.14.6 - [Release notes](https://github.com/gradle/gradle/releases) - [Commits](gradle/gradle@v8.5.0...v8.14.6) Updates `gradle-wrapper` from 8.0.2 to 8.14.6 - [Release notes](https://github.com/gradle/gradle/releases) - [Commits](gradle/gradle@v8.5.0...v8.14.6) Updates `gradle-wrapper` from 8.0.2 to 8.14.6 - [Release notes](https://github.com/gradle/gradle/releases) - [Commits](gradle/gradle@v8.5.0...v8.14.6) Updates `gradle-wrapper` from 8.0.2 to 8.14.6 - [Release notes](https://github.com/gradle/gradle/releases) - [Commits](gradle/gradle@v8.5.0...v8.14.6) Updates `gradle-wrapper` from 8.0.2 to 8.14.6 - [Release notes](https://github.com/gradle/gradle/releases) - [Commits](gradle/gradle@v8.5.0...v8.14.6) Updates `gradle-wrapper` from 8.0.2 to 8.14.6 - [Release notes](https://github.com/gradle/gradle/releases) - [Commits](gradle/gradle@v8.5.0...v8.14.6) Updates `gradle-wrapper` from 8.0.2 to 8.14.6 - [Release notes](https://github.com/gradle/gradle/releases) - [Commits](gradle/gradle@v8.5.0...v8.14.6) Updates `gradle-wrapper` from 8.0.2 to 8.14.6 - [Release notes](https://github.com/gradle/gradle/releases) - [Commits](gradle/gradle@v8.5.0...v8.14.6) Updates `gradle-wrapper` from 8.0.2 to 8.14.6 - [Release notes](https://github.com/gradle/gradle/releases) - [Commits](gradle/gradle@v8.5.0...v8.14.6) Updates `gradle-wrapper` from 8.0.2 to 8.14.6 - [Release notes](https://github.com/gradle/gradle/releases) - [Commits](gradle/gradle@v8.5.0...v8.14.6) Updates `gradle-wrapper` from 8.0.2 to 8.14.6 - [Release notes](https://github.com/gradle/gradle/releases) - [Commits](gradle/gradle@v8.5.0...v8.14.6) Updates `gradle-wrapper` from 8.0.2 to 8.14.6 - [Release notes](https://github.com/gradle/gradle/releases) - [Commits](gradle/gradle@v8.5.0...v8.14.6) Updates `gradle-wrapper` from 8.0.2 to 8.14.6 - [Release notes](https://github.com/gradle/gradle/releases) - [Commits](gradle/gradle@v8.5.0...v8.14.6) Updates `gradle-wrapper` from 8.0.2 to 8.14.6 - [Release notes](https://github.com/gradle/gradle/releases) - [Commits](gradle/gradle@v8.5.0...v8.14.6) Updates `gradle-wrapper` from 8.0.2 to 8.14.6 - [Release notes](https://github.com/gradle/gradle/releases) - [Commits](gradle/gradle@v8.5.0...v8.14.6) Updates `gradle-wrapper` from 8.0.2 to 8.14.6 - [Release notes](https://github.com/gradle/gradle/releases) - [Commits](gradle/gradle@v8.5.0...v8.14.6) Updates `gradle-wrapper` from 8.0.2 to 8.14.6 - [Release notes](https://github.com/gradle/gradle/releases) - [Commits](gradle/gradle@v8.5.0...v8.14.6) Updates `gradle-wrapper` from 8.0.2 to 8.14.6 - [Release notes](https://github.com/gradle/gradle/releases) - [Commits](gradle/gradle@v8.5.0...v8.14.6) Updates `gradle-wrapper` from 8.0.2 to 8.14.6 - [Release notes](https://github.com/gradle/gradle/releases) - [Commits](gradle/gradle@v8.5.0...v8.14.6) Updates `gradle-wrapper` from 8.0.2 to 8.14.6 - [Release notes](https://github.com/gradle/gradle/releases) - [Commits](gradle/gradle@v8.5.0...v8.14.6) Updates `gradle-wrapper` from 8.0.2 to 8.14.6 - [Release notes](https://github.com/gradle/gradle/releases) - [Commits](gradle/gradle@v8.5.0...v8.14.6) Updates `gradle-wrapper` from 8.0.2 to 8.14.6 - [Release notes](https://github.com/gradle/gradle/releases) - [Commits](gradle/gradle@v8.5.0...v8.14.6) Updates `gradle-wrapper` from 8.0.2 to 8.14.6 - [Release notes](https://github.com/gradle/gradle/releases) - [Commits](gradle/gradle@v8.5.0...v8.14.6) Updates `gradle-wrapper` from 8.0.2 to 8.14.6 - [Release notes](https://github.com/gradle/gradle/releases) - [Commits](gradle/gradle@v8.5.0...v8.14.6) Updates `gradle-wrapper` from 8.0.2 to 8.14.6 - [Release notes](https://github.com/gradle/gradle/releases) - [Commits](gradle/gradle@v8.5.0...v8.14.6) Updates `gradle-wrapper` from 8.0.2 to 8.14.6 - [Release notes](https://github.com/gradle/gradle/releases) - [Commits](gradle/gradle@v8.5.0...v8.14.6) Updates `gradle-wrapper` from 8.0.2 to 8.14.6 - [Release notes](https://github.com/gradle/gradle/releases) - [Commits](gradle/gradle@v8.5.0...v8.14.6) --- updated-dependencies: - dependency-name: gradle-wrapper dependency-version: 8.14.6 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle - dependency-name: gradle-wrapper dependency-version: 8.14.6 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle - dependency-name: gradle-wrapper dependency-version: 8.14.6 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle - dependency-name: gradle-wrapper dependency-version: 8.14.6 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle - dependency-name: gradle-wrapper dependency-version: 8.14.6 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle - dependency-name: gradle-wrapper dependency-version: 8.14.6 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle - dependency-name: gradle-wrapper dependency-version: 8.14.6 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle - dependency-name: gradle-wrapper dependency-version: 8.14.6 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle - dependency-name: gradle-wrapper dependency-version: 8.14.6 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle - dependency-name: gradle-wrapper dependency-version: 8.14.6 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle - dependency-name: gradle-wrapper dependency-version: 8.14.6 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle - dependency-name: gradle-wrapper dependency-version: 8.14.6 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle - dependency-name: gradle-wrapper dependency-version: 8.14.6 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle - dependency-name: gradle-wrapper dependency-version: 8.14.6 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle - dependency-name: gradle-wrapper dependency-version: 8.14.6 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle - dependency-name: gradle-wrapper dependency-version: 8.14.6 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle - dependency-name: gradle-wrapper dependency-version: 8.14.6 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle - dependency-name: gradle-wrapper dependency-version: 8.14.6 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle - dependency-name: gradle-wrapper dependency-version: 8.14.6 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle - dependency-name: gradle-wrapper dependency-version: 8.14.6 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle - dependency-name: gradle-wrapper dependency-version: 8.14.6 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle - dependency-name: gradle-wrapper dependency-version: 8.14.6 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle - dependency-name: gradle-wrapper dependency-version: 8.14.6 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle - dependency-name: gradle-wrapper dependency-version: 8.14.6 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle - dependency-name: gradle-wrapper dependency-version: 8.14.6 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle - dependency-name: gradle-wrapper dependency-version: 8.14.6 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle - dependency-name: gradle-wrapper dependency-version: 8.14.6 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle - dependency-name: gradle-wrapper dependency-version: 8.14.6 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gradle ... Signed-off-by: dependabot[bot] <support@github.com>
Kotlin migration progressNo change to the Java left to convert.
Conversion progress: 0.0% (16,728 of 16,550 baseline Java LOC left to convert). 132 Java files and 36 Kotlin files in scope. |
Binary compatibility
Compares the release AAR against the same artifact at the last version published to Maven Central; R8-renamed classes and members are excluded (see the script docstring). Full japicmp HTML/XML reports are attached as the |
There was a problem hiding this comment.
I reviewed this PR and found no bugs. A human should still look at it before merging, because it replaces 28 checked-in gradle-wrapper.jar binaries and every path in the repo is covered by CODEOWNERS.
What was reviewed:
- Every gradle-wrapper.properties now points distributionUrl at gradle-8.14.6-bin.zip. None of them sets distributionSha256Sum, before or after this change.
- All the new gradle-wrapper.jar files are byte-identical: the root, rokt and onetrust copies all have SHA-256 ad16bca4…37e0. I couldn't check that hash against Gradle's published wrapper checksums, and no CI workflow runs wrapper validation.
- Kit builds use AGP 8.1.4, which works with Gradle 8.14. Only the branch-5 and urbanairship-20 sample apps pin older AGP (3.1.1 and 7.4.2). Kit builds aren't required checks, so a red build-kits job could still merge.
Extended reasoning...
This Dependabot change updates the Gradle wrapper (properties file, jar, gradlew and gradlew.bat) in the root build and in all 27 kit directories, moving from 8.5 or 8.0.2 to 8.14.6. It doesn't touch app source, auth, crypto or data handling. The security-relevant part is the supply chain: 28 opaque wrapper jars are replaced, there is no distribution checksum pinning and no wrapper-validation step in CI. The decision was a defer rather than an approve because the CODEOWNERS file assigns every path to the SDK team, and the replaced binaries can't be fully verified from the diff alone.
📦 SDK Size Impact ReportWhat the SDK adds to a minified release APK. mParticle Core SDKMeasured against an empty baseline app. Unlike the Rokt kit, android-core ships no Compose and no resources, so there is nothing here that a host app would already provide.
mParticle Core + Rokt kitMeasured against a Compose + Material3 reference app, so these are the costs on top of an app that already ships Compose. The reference app's dependencies are a documented convention, not a measured average: see
Rokt SDK+ umbrella (adds the payment extension)
➡️ SDK size impact change is minimal. Raw measurementscore, Target branch: {"baseline_dex_bytes": 0, "baseline_download_bytes": 2510, "baseline_install_bytes": 7527, "core_dex_bytes": 220412, "core_download_bytes": 123805, "core_install_bytes": 131055}core, This PR: {"baseline_dex_bytes": 0, "baseline_download_bytes": 2511, "baseline_install_bytes": 7527, "core_dex_bytes": 220412, "core_download_bytes": 123804, "core_install_bytes": 131057}rokt, Target branch: {"baseline_dex_bytes": 1829108, "baseline_download_bytes": 1240062, "baseline_install_bytes": 1300934, "kit_dex_bytes": 4170020, "kit_download_bytes": 2548125, "kit_install_bytes": 2623275, "sdkplus_dex_bytes": 9291568, "sdkplus_download_bytes": 7985699, "sdkplus_install_bytes": 8165359}rokt, This PR: {"baseline_dex_bytes": 1829108, "baseline_download_bytes": 1240062, "baseline_install_bytes": 1300934, "kit_dex_bytes": 4170020, "kit_download_bytes": 2548124, "kit_install_bytes": 2623275, "sdkplus_dex_bytes": 9291568, "sdkplus_download_bytes": 7985700, "sdkplus_install_bytes": 8165359} |
Bumps gradle-wrapper in
/from 8.5 to 8.14.6.Updates
gradle-wrapperfrom 8.5 to 8.14.6Release notes
Sourced from gradle-wrapper's releases.
... (truncated)
Commits
88c80c1Release notes for 8.14.6 (#39421)1ee2186Release notes for 8.14.6af0275ePrepare 8.14.6 (#39400)32c6a87Security backport for 8.x (#39415)b10d746Check worker token before any serialization similarly to daemon454497bCheck the daemon token before any serializationa700d72Refuse connections from non-Gradle processesd4583efWrap GCP & S3 resolution errors into HTTP to reuse repository disabling mecha...ed14ef8Harden repository disabling: disable them by default on failure unless there'...ee03c24Replace credentials for distribution url with *** and avoid showing the plain...Updates
gradle-wrapperfrom 8.0.2 to 8.14.6Release notes
Sourced from gradle-wrapper's releases.
... (truncated)
Commits
88c80c1Release notes for 8.14.6 (#39421)1ee2186Release notes for 8.14.6af0275ePrepare 8.14.6 (#39400)32c6a87Security backport for 8.x (#39415)b10d746Check worker token before any serialization similarly to daemon454497bCheck the daemon token before any serializationa700d72Refuse connections from non-Gradle processesd4583efWrap GCP & S3 resolution errors into HTTP to reuse repository disabling mecha...ed14ef8Harden repository disabling: disable them by default on failure unless there'...ee03c24Replace credentials for distribution url with *** and avoid showing the plain...Updates
gradle-wrapperfrom 8.0.2 to 8.14.6Release notes
Sourced from gradle-wrapper's releases.
... (truncated)
Commits
88c80c1Release notes for 8.14.6 (#39421)1ee2186Release notes for 8.14.6af0275ePrepare 8.14.6 (#39400)32c6a87Security backport for 8.x (#39415)b10d746Check worker token before any serialization similarly to daemon454497bCheck the daemon token before any serializationa700d72Refuse connections from non-Gradle processesd4583efWrap GCP & S3 resolution errors into HTTP to reuse repository disabling mecha...ed14ef8Harden repository disabling: disable them by default on failure unless there'...ee03c24Replace credentials for distribution url with *** and avoid showing the plain...Updates
gradle-wrapperfrom 8.0.2 to 8.14.6Release notes
Sourced from gradle-wrapper's releases.
... (truncated)
Commits
88c80c1Release notes for 8.14.6 (#39421)1ee2186Release notes for 8.14.6af0275ePrepare 8.14.6 (#39400)32c6a87Security backport for 8.x (#39415)b10d746Check worker token before any serialization similarly to daemon454497bCheck the daemon token before any serializationa700d72Refuse connections from non-Gradle processesd4583efWrap GCP & S3 resolution errors into HTTP to reuse repository disabling mecha...ed14ef8Harden repository disabling: disable them by default on failure unless there'...ee03c24Replace credentials for distribution url with *** and avoid showing the plain...Updates
gradle-wrapperfrom 8.0.2 to 8.14.6Release notes
Sourced from gradle-wrapper's releases.
... (truncated)
Commits
88c80c1Release notes for 8.14.6 (#39421)1ee2186Release notes for 8.14.6af0275ePrepare 8.14.6 (#39400)32c6a87Security backport for 8.x (#39415)b10d746Check worker token before any serialization similarly to daemon454497bCheck the daemon token before any serializationa700d72Refuse connections from non-Gradle processesd4583efWrap GCP & S3 resolution errors into HTTP to reuse repository disabling mecha...ed14ef8Harden repository disabling: disable them by default on failure unless there'...ee03c24Replace credentials for distribution url with *** and avoid showing the plain...Updates
gradle-wrapperfrom 8.0.2 to 8.14.6Release notes
Sourced from gradle-wrapper's releases.
... (truncated)
Commits
88c80c1Release notes for 8.14.6 (#39421)1ee2186Release notes for 8.14.6af0275ePrepare 8.14.6 (#39400)32c6a87Security backport for 8.x (#39415)b10d746Check worker token before any serialization similarly to daemon454497bCheck the daemon token before any serializationa700d72Refuse connections from non-Gradle processesd4583efWrap GCP & S3 resolution errors into HTTP to reuse repository disabling mecha...ed14ef8Harden repository disabling: disable them by default on failure unless there'...ee03c24Replace credentials for distribution url with *** and avoid showing the plain...Updates
gradle-wrapperfrom 8.0.2 to 8.14.6Release notes
Sourced from gradle-wrapper's releases.
... (truncated)
Commits
88c80c1Release notes for 8.14.6 (#39421)1ee2186Release notes for 8.14.6af0275ePrepare 8.14.6 (#39400)32c6a87Security backport for 8.x (#39415)b10d746Check worker token before any serialization similarly to daemon454497bCheck the daemon token before any serializationa700d72Refuse connections from non-Gradle processesd4583efWrap GCP & S3 resolution errors into HTTP to reuse repository disabling mecha...ed14ef8Harden repository disabling: disable them by default on failure unless there'...ee03c24Replace credentials for distribution url with *** and avoid showing the plain...Updates
gradle-wrapperfrom 8.0.2 to 8.14.6Release notes
Sourced from gradle-wrapper's releases.
... (truncated)
Commits
88c80c1Release notes for 8.14.6 (#39421)1ee2186Release notes for 8.14.6af0275ePrepare 8.14.6 (#39400)32c6a87Security backport for 8.x (#39415)b10d746Check worker token before any serialization similarly to daemon454497bCheck the daemon token before any serializationa700d72Refuse connections from non-Gradle processesd4583efWrap GCP & S3 resolution errors into HTTP to reuse repository disabling mecha...ed14ef8Harden repository disabling: disable them by default on failure unless there'...ee03c24Replace credentials for distribution url with *** and avoid showing the plain...Updates
gradle-wrapperfrom 8.0.2 to 8.14.6Release notes
Sourced from gradle-wrapper's releases.
... (truncated)
Commits
88c80c1Release notes for 8.14.6 (#39421)1ee2186Release notes for 8.14.6af0275ePrepare 8.14.6 (#39400)32c6a87Security backport for 8.x (#39415)b10d746Check worker token before any serialization similarly to daemon454497bCheck the daemon token before any serializationa700d72Refuse connections from non-Gradle processesd4583efWrap GCP & S3 resolution errors into HTTP to reuse repository disabling mecha...ed14ef8Harden repository disabling: disable them by default on failure unless there'...ee03c24Replace credentials for distribution url with *** and avoid showing the plain...Updates
gradle-wrapperfrom 8.0.2 to 8.14.6Release notes
Sourced from gradle-wrapper's releases.
... (truncated)
Commits
88c80c1Release notes for 8.14.6 (#39421)1ee2186Release notes for 8.14.6af0275ePrepare 8.14.6 (#39400)32c6a87Security backport for 8.x (#39415)b10d746Check worker token before any serialization similarly to daemon454497bCheck the daemon token before any serializationa700d72Refuse connections from non-Gradle processesd4583efWrap GCP & S3 resolution errors into HTTP to reuse repository disabling mecha...ed14ef8Harden repository disabling: disable them by default on failure unless there'...ee03c24Replace credentials for distribution url with *** and avoid showing the plain...Updates
gradle-wrapperfrom 8.0.2 to 8.14.6Release notes
Sourced from gradle-wrapper's releases.
... (truncated)
Commits
88c80c1Release notes for 8.14.6 (#39421)1ee2186Release notes for 8.14.6af0275ePrepare 8.14.6 (#39400)32c6a87Security backport for 8.x (#39415)b10d746Check worker token before any serialization similarly to daemon454497bCheck the daemon token before any serializationa700d72Refuse connections from non-Gradle processesd4583efWrap GCP & S3 resolution errors into HTTP to reuse repository disabling mecha...ed14ef8Harden repository disabling: disable them by default on failure unless there'...ee03c24Replace credentials for distribution url with *** and avoid showing the plain...Updates
gradle-wrapperfrom 8.0.2 to 8.14.6Release notes
Sourced from gradle-wrapper's releases.
... (truncated)
Commits
88c80c1Release notes for 8.14.6 (#39421)1ee2186Release notes for 8.14.6af0275ePrepare 8.14.6 (#39400)32c6a87Security backport for 8.x (#39415)b10d746Check worker token before any serialization similarly to daemon454497bCheck the daemon token before any serializationa700d72Refuse connections from non-Gradle processesd4583efWrap GCP & S3 resolution errors into HTTP to reuse repository disabling mecha...ed14ef8Harden repository disabling: disable them by default on failure unless there'...ee03c24Replace credentials for distribution url with *** and avoid showing the plain...Updates
gradle-wrapperfrom 8.0.2 to 8.14.6Release notes
Sourced from gradle-wrapper's releases.
... (truncated)
Commits
88c80c1Release notes for 8.14.6 (#39421)1ee2186Release notes for 8.14.6af0275ePrepare 8.14.6 (#39400)32c6a87Security backport for 8.x (#39415)b10d746Check worker token before any serialization similarly to daemon454497bCheck the daemon token before any serializationa700d72Refuse connections from non-Gradle processesd4583efWrap GCP & S3 resolution errors into HTTP to reuse repository disabling mecha...ed14ef8Harden repository disabling: disable them by default on failure unless there'...ee03c24Replace credentials for distribution url with *** and avoid showing the plain...Updates
gradle-wrapperfrom 8.0.2 to 8.14.6Release notes
Sourced from gradle-wrapper's releases.