Skip to content

fix(deps): update gradle shadow packages to v9 (major) #14388

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: main
Choose a base branch
from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Aug 7, 2025

This PR contains the following updates:

Package Change Age Confidence
com.gradleup.shadow:shadow-gradle-plugin 8.3.9 -> 9.0.0 age confidence
com.gradleup.shadow 8.3.9 -> 9.0.0 age confidence

Release Notes

GradleUp/shadow (com.gradleup.shadow:shadow-gradle-plugin)

v9.0.0

Compare Source

[!WARNING]
This release is a major update from the 8.x series. The plugin has been fully rewritten in Kotlin, bringing
significant improvements to maintainability, performance, and future extensibility. It introduces many new features,
enhancements, and bug fixes, and includes several breaking changes. Please review the changelog carefully and consult
the new doc site before upgrading.

If you really don't want to upgrade, you can still use the 8.3.x, which is also Gradle 9 compatible. But no additional features or crucial bug fixes will be included in the 8.x line.

[!TIP]
You can diff the shadowed JARs when upgrading from 8.x to 9.x by using Diffuse.
If there are any things missing in the changelog or the doc site, please report them to us.

Added
  • Add .md support to the Apache License and Notice transformers. (#​1041)
  • Sync SimpleRelocator changes from maven-shade-plugin. (#​1076)
  • Support configuring separator in AppendingTransformer. (#​1169)
    This is useful for handling files like resources/application.yml.
  • Exclude module-info.class in Multi-Release folders by default. (#​1177)
  • Inject TargetJvmVersion attribute for Gradle Module Metadata. (#​1199)
  • Sync ShadowApplicationPlugin with ApplicationPlugin. (#​1224)
  • Inject Multi-Release manifest attribute if any dependency contains it. (#​1239)
  • Mark Transformer as throwing IOException. (#​1248)
  • Reduce duplicate SimpleRelocator to improve performance. (#​1271)
  • Compat Kotlin Multiplatform plugin. (#​1280)
  • Add Kotlin DSL examples in docs. (#​1306)
  • Support using type-safe dependency accessors in ShadowJar.dependencies. (#​1322)
  • Support command line options for ShadowJar. (#​1365)
    --enable-auto-relocation          Enables auto relocation of packages in the dependencies.
    --no-enable-auto-relocation       Disables option --enable-auto-relocation.
    --fail-on-duplicate-entries       Fails build if the ZIP entries in the shadowed JAR are duplicate.
    --no-fail-on-duplicate-entries    Disables option --fail-on-duplicate-entries.
    --minimize-jar                    Minimizes the jar by removing unused classes.
    --no-minimize-jar                 Disables option --minimize-jar.
    --relocation-prefix               Prefix used for auto relocation of packages in the dependencies.
    --rerun                           Causes the task to be re-run even if up-to-date.
    
  • Support skipping string constant remapping. (#​1401)
  • Let assemble depend on shadowJar. (#​1524)
  • Fail build when inputting AAR files or using Shadow with AGP. (#​1530)
  • Add PreserveFirstFoundResourceTransformer. (#​1548)
    This is useful when you set shadowJar.duplicatesStrategy = DuplicatesStrategy.INCLUDE (the default behavior) and
    want to ensure that only the first found resource is included in the final JAR.
  • Fail build if the ZIP entries in the shadowed JAR are duplicate. (#​1552)
    This feature is controlled by the shadowJar.failOnDuplicateEntries property, which is false by default.
    Related to setting duplicatesStrategy = DuplicatesStrategy.FAIL but there are some differences:
    • It only checks the entries in the shadowed jar, not the input files.
    • It works with setting duplicatesStrategy to any value.
    • It provides a stricter fallback check before the JAR is created.
Changed
  • BREAKING CHANGE: Rewrite this plugin in Kotlin. (#​1012)
  • BREAKING CHANGE: Migrate Transformers to using lazy properties. (#​1036)
  • BREAKING CHANGE: Migrate ShadowJar to using lazy properties. (#​1044)
  • BREAKING CHANGE: Resolve Configuration directly in DependencyFilter. (#​1045)
  • BREAKING CHANGE: Migrate SimpleRelocator to using lazy properties. (#​1047)
  • BREAKING CHANGE: Some public getters have been updated in SimpleRelocator. (#​1079)
  • BREAKING CHANGE: Migrate all ListProperty usages to SetProperty. (#​1103)
    Some public List parameters are also changed to Set.
  • BREAKING CHANGE: Mark RelocatorRemapper as internal. (#​1227)
  • BREAKING CHANGE: Bump min Java requirement to 11. (#​1242)
  • BREAKING CHANGE: Move tracking unused classes logic out of ShadowCopyAction. (#​1257)
  • BREAKING CHANGE: Move DependencyFilter into tasks package. (#​1272)
  • BREAKING CHANGE: Change the default duplicatesStrategy from EXCLUDE to INCLUDE. (#​1233)
    • ShadowJar recognized EXCLUDE as the default, but the other strategies didn't work properly.
    • Now ShadowJar honors INCLUDE as the default, and aligns all the strategy behaviors with the Gradle side.
    • mergeServiceFiles and ServiceFileTransformer do not work with EXCLUDE, as it will exclude extra service files to be merged.
    • Duplicate entries might be bundled due to this change, but you can reduce them by using the newly added PreserveFirstFoundResourceTransformer.
    • Use filesMatching to override the default strategy for specific files.
    • Set failOnDuplicateEntries = true to fail the build to check for duplicate entries.
    • See more details at Handling Duplicates Strategy.
  • BREAKING CHANGE: Align the behavior of ShadowTask.from with Gradle's AbstractCopyTask.from. (#​1233)
    In the previous versions, ShadowTask.from would always unzip the files before processing them, which caused serial
    issues that are hard to fix. Now it behaves like Gradle's AbstractCopyTask.from, which means it will not unzip
    the files, only copy the files as-is. If you still want to shadow the unzipped files, try out something like:
      tasks.shadowJar {
        // Unzip the files before pass them to `from` by using `zipTree`.
        from(zipTree(files('path/to/your/file.zip')))
      }
    or
      dependencies {
        // Add the files to `implementation` configuration, Shadow will unzip them automatically.
        implementation(files('path/to/your/file.zip'))
      }
  • BREAKING CHANGE: Rename Transformer to ResourceTransformer. (#​1288)
    Aims to better align with the name org.apache.maven.plugins.shade.resource.ResourceTransformer.java
    and to distinguish itself from org.gradle.api.Transformer.java.
  • BREAKING CHANGE: Mark DefaultInheritManifest as internal. (#​1303)
  • BREAKING CHANGE: Polish ShadowSpec. (#​1307)
    • Return values of ShadowSpec functions are changed to Unit to avoid confusion.
    • ShadowSpec no longer extends CopySpec.
    • Overload relocate, transform and things for better usability in Kotlin.
  • BREAKING CHANGE: Remove redundant types from function returning. (#​1308)
  • BREAKING CHANGE: Rename ShadowJar's isEnableRelocation to enableAutoRelocation. (#​1541)
  • BREAKING CHANGE: Some const values in ShadowBasePlugin and ShadowJavaPlugin are moved. (#​1589)
    You can find them in ShadowJar, ShadowApplicationPlugin, and ShadowJavaPlugin.
  • Replace deprecated SelfResolvingDependency with FileCollectionDependency. (#​1114)
  • Update start script templates. (#​1183)
  • Mark more Transformers cacheable. (#​1210)
  • Mark ShadowJar.dependencyFilter as @Input. (#​1206)
  • Polish startShadowScripts task registering. (#​1216)
  • Refactor file visiting logic in StreamAction, handle file unzipping via Project.zipTree. (#​1233)
  • Migrate doc sites to MkDocs. (#​1302)
  • runShadow no longer depends on installShadowDist. (#​1353)
  • Move the group of ShadowJar from shadow to build. (#​1355)
  • In-development snapshots are now published to the Central Portal Snapshots repository. (#​1414)
  • Expose AbstractDependencyFilter from internal to public. (#​1538)
    You can access it via com.github.jengelman.gradle.plugins.shadow.tasks.DependencyFilter.AbstractDependencyFilter.
  • Mark Action parameters as non-null. (#​1555)
  • Use BufferedOutputStream when writing the Zip file to improve performance. (#​1580)
Fixed
  • Fix single Log4j2Plugins.dat isn't included into fat jar. (#​1039)
  • Fail builds if processing bad jars. (#​1146)
  • Fix Log4j2PluginsCacheFileTransformer not working for merging Log4j2Plugins.dat files. (#​1175)
  • Support overriding mainClass provided by JavaApplication. (#​1182)
  • Fix ShadowJar not being successful after includes or excludes are changed. (#​1200)
  • Honor DuplicatesStrategy. (#​1233)
  • Honor unzipped jars via from. (#​1233)
  • Fix the last modified time of shadowed directories. (#​1277)
  • Fix relocation exclusion for file patterns like kotlin/kotlin.kotlin_builtins. (#​1313)
  • Allow using file trees of JARs together with the configuration cache. (#​1441)
Removed
  • BREAKING CHANGE: Some public getters and setters have been removed in SimpleRelocator. (#​1079)
  • BREAKING CHANGE: Remove JavaJarExec, now use JavaExec directly for runShadow task. (#​1197)
  • BREAKING CHANGE: ServiceFileTransformer.ServiceStream has been removed. (#​1218)
  • BREAKING CHANGE: Remove KnowsTask as it's useless. (#​1236)
  • BREAKING CHANGE: Remove BaseStreamAction. (#​1258)
  • BREAKING CHANGE: Remove ShadowStats. (#​1264)
  • BREAKING CHANGE: Remove ShadowCopyAction.ArchiveFileTreeElement and RelativeArchivePath. (#​1233)
  • BREAKING CHANGE: Remove TransformerContext.getEntryTimestamp. (#​1245)
  • BREAKING CHANGE: Reduce dependency and project overloads in DependencyFilter. (#​1328)
  • BREAKING CHANGE: Remove ShadowSpec. (#​1560)
  • BREAKING CHANGE: Remove Relocator.ROLE. (#​1563)
  • BREAKING CHANGE: Remove deprecated ShadowExtension.component. (#​1586)
Migration Example

8.x

tasks.shadowJar {
  isEnableRelocation = true
  duplicatesStrategy = DuplicatesStrategy.EXCLUDE
  mergeServiceFiles()
  from("foo.jar")
}

9.x

tasks.shadowJar {
  // `isEnableRelocation` has been renamed to `enableAutoRelocation`.
  enableAutoRelocation = true

  // The default `duplicatesStrategy` has been changed from `EXCLUDE` to `INCLUDE`.
  duplicatesStrategy = DuplicatesStrategy.INCLUDE
  // If you want to make `mergeServiceFiles` work, should leave the `duplicatesStrategy` as `INCLUDE`.
  // `EXCLUDE` will exclude extra service files to be merged.
  mergeServiceFiles()
  // If you leave `duplicatesStrategy` as `INCLUDE`, you can use the new `PreserveFirstFoundResourceTransformer`
  // to ensure that only the first found resource is included in the final JAR. Or duplicate entries will be bundled.
  transform<PreserveFirstFoundResourceTransformer>() {
    resources.add("META-INF/some-resource.txt")
  }
  // Optionally, you can enable the new `failOnDuplicateEntries` property to fail the build if there are duplicate entries.
  failOnDuplicateEntries = true

  // If you want to keep the `foo.jar` as-is (zipped), you can use the `from` method directly. This is different from the previous.
  from("foo.jar")
  // If you want to unzip the `foo.jar` before processing, you can use `zipTree` to unzip it.
  from(zipTree("foo.jar"))
}
New Contributors

Full Changelog: GradleUp/shadow@8.3.9...9.0.0


Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot requested a review from a team as a code owner August 7, 2025 04:52
@otelbot-java-instrumentation
Copy link
Contributor

🔧 The result from generateLicenseReport was committed to the PR branch.

Copy link
Contributor Author

renovate bot commented Aug 7, 2025

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

@SylvainJuge
Copy link
Contributor

Even after fixing a few API changes, we still have unexpected circular dependencies, for example:

Circular dependency between the following tasks:
:instrumentation:netty:netty-3.8:javaagent:shadowJar
+--- :instrumentation:netty:netty-4.0:javaagent:shadowJar
|    +--- :instrumentation:netty:netty-3.8:javaagent:shadowJar (*)
|    \--- :instrumentation:netty:netty-4.1:javaagent:shadowJar
|         +--- :instrumentation:netty:netty-3.8:javaagent:shadowJar (*)
|         \--- :instrumentation:netty:netty-4.0:javaagent:shadowJar (*)
\--- :instrumentation:netty:netty-4.1:javaagent:shadowJar (*)

(*) - details omitted (listed previously)

This is not specific to this netty instrumentation, even when removing those "circular" dependencies in netty we get similar ones with other instrumentations. Maybe something changed in the shadowJar task dependencies resolution with the new plugin version.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant