fix(deps): update gradle shadow packages to v9 (major)

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
com.gradleup.shadow:shadow-gradle-plugin	8.3.9 -> 9.1.0
com.gradleup.shadow	8.3.9 -> 9.1.0

---

Release Notes

GradleUp/shadow (com.gradleup.shadow:shadow-gradle-plugin)

v9.1.0

Compare Source

Added

• Allow opting out of shadowRuntimeElements variant. (#​1662)
• Allow opting out of TARGET_JVM_VERSION_ATTRIBUTE. (#​1674)
• Allow opting out of Multi-Release attribute. (#​1675)

Changed

• Don't inject TargetJvmVersion attribute when automatic JVM targeting is disabled. (#​1666)
• Do not write modified class files for no-op relocations. (#​1694)

v9.0.2

Compare Source

Fixed

• Fix missing space in ApacheNoticeResourceTransformer preamble causing malformed NOTICE header. (#​1623)
• Fix using ApacheNoticeResourceTransformer without projectName. (#​1627)
• Fix extra indents of ApacheNoticeResourceTransformer output. (#​1628)
• Fix resolving BOM dependencies when minimize is enabled. (#​1637)

v9.0.1

Compare Source

[!NOTE]
If you are upgrading from 8.x versions, please read 9.0.0 release notes first.

[!TIP]
You can diff the shadowed JARs when upgrading from 8.x to 9.x by using Diffuse.
If there are any things missing in the changelog or the doc site, please report them to us.

Changed

• Improve the error message for empty mainClassName. (#​1601)
• Default duplicatesStrategy back to EXCLUDE. (#​1617)
  • This strategy is consistent with 8.x series behavior, which is more compatible for most users upgrading.
  • For most ResourceTransformer users, you need to override the strategy to INCLUDE to make them work.
  • Strongly suggest declaring the duplicatesStrategy explicitly in your ShadowJar configuration to avoid confusion.
  • See more details about the strategies at Handling Duplicates Strategy.

Fixed

• Fix the regression of can't shadow directory inputs. (#​1606)
• Fix the regression of MinimizeDependencyFilter. (#​1611)

v9.0.0

Compare Source

[!WARNING]
This release is a major update from the 8.x series. The plugin has been fully rewritten in Kotlin, bringing
significant improvements to maintainability, performance, and future extensibility. It introduces many new features,
enhancements, and bug fixes, and includes several breaking changes. Please review the changelog carefully and consult
the new doc site before upgrading.

If you really don't want to upgrade, you can still use the 8.3.x, which is also Gradle 9 compatible. But no additional features or crucial bug fixes will be included in the 8.x line.

[!TIP]
You can diff the shadowed JARs when upgrading from 8.x to 9.x by using Diffuse.
If there are any things missing in the changelog or the doc site, please report them to us.

Added

• Add .md support to the Apache License and Notice transformers. (#​1041)
• Sync SimpleRelocator changes from maven-shade-plugin. (#​1076)
• Support configuring separator in AppendingTransformer. (#​1169)
  This is useful for handling files like resources/application.yml.
• Exclude module-info.class in Multi-Release folders by default. (#​1177)
• Inject TargetJvmVersion attribute for Gradle Module Metadata. (#​1199)
• Sync ShadowApplicationPlugin with ApplicationPlugin. (#​1224)
• Inject Multi-Release manifest attribute if any dependency contains it. (#​1239)
• Mark Transformer as throwing IOException. (#​1248)
• Reduce duplicate SimpleRelocator to improve performance. (#​1271)
• Compat Kotlin Multiplatform plugin. (#​1280)
• Add Kotlin DSL examples in docs. (#​1306)
• Support using type-safe dependency accessors in ShadowJar.dependencies. (#​1322)
• Support command line options for ShadowJar. (#​1365)

  --enable-auto-relocation          Enables auto relocation of packages in the dependencies.
  --no-enable-auto-relocation       Disables option --enable-auto-relocation.
  --fail-on-duplicate-entries       Fails build if the ZIP entries in the shadowed JAR are duplicate.
  --no-fail-on-duplicate-entries    Disables option --fail-on-duplicate-entries.
  --minimize-jar                    Minimizes the jar by removing unused classes.
  --no-minimize-jar                 Disables option --minimize-jar.
  --relocation-prefix               Prefix used for auto relocation of packages in the dependencies.
  --rerun                           Causes the task to be re-run even if up-to-date.
  

• Support skipping string constant remapping. (#​1401)
• Let assemble depend on shadowJar. (#​1524)
• Fail build when inputting AAR files or using Shadow with AGP. (#​1530)
• Add PreserveFirstFoundResourceTransformer. (#​1548)
  This is useful when you set shadowJar.duplicatesStrategy = DuplicatesStrategy.INCLUDE and
  want to ensure that only the first found resource is included in the final JAR.
• Fail build if the ZIP entries in the shadowed JAR are duplicate. (#​1552)
  This feature is controlled by the shadowJar.failOnDuplicateEntries property, which is false by default.
  Related to setting duplicatesStrategy = DuplicatesStrategy.FAIL but there are some differences:
  • It only checks the entries in the shadowed jar, not the input files.
  • It works with setting duplicatesStrategy to any value.
  • It provides a stricter fallback check before the JAR is created.

Changed

• BREAKING CHANGE: Rewrite this plugin in Kotlin. (#​1012)
• BREAKING CHANGE: Migrate Transformers to using lazy properties. (#​1036)
• BREAKING CHANGE: Migrate ShadowJar to using lazy properties. (#​1044)
• BREAKING CHANGE: Resolve Configuration directly in DependencyFilter. (#​1045)
• BREAKING CHANGE: Migrate SimpleRelocator to using lazy properties. (#​1047)
• BREAKING CHANGE: Some public getters have been updated in SimpleRelocator. (#​1079)
• BREAKING CHANGE: Migrate all ListProperty usages to SetProperty. (#​1103)
  Some public List parameters are also changed to Set.
• BREAKING CHANGE: Mark RelocatorRemapper as internal. (#​1227)
• BREAKING CHANGE: Bump min Java requirement to 11. (#​1242)
• BREAKING CHANGE: Move tracking unused classes logic out of ShadowCopyAction. (#​1257)
• BREAKING CHANGE: Move DependencyFilter into tasks package. (#​1272)
• BREAKING CHANGE: Change the default duplicatesStrategy from EXCLUDE to INCLUDE. (#​1233)
  • ShadowJar recognized EXCLUDE as the default, but the other strategies didn't work properly.
  • Now ShadowJar honors INCLUDE as the default, and aligns all the strategy behaviors with the Gradle side.
  • Some ResourceTransformers (e.g. ServiceFileTransformer) do not work with EXCLUDE, as it will exclude duplicate resources to be merged.
  • Duplicate entries might be bundled due to this change, but you can reduce them by using the newly added PreserveFirstFoundResourceTransformer.
  • Use filesMatching to override the default strategy for specific files.
  • Set failOnDuplicateEntries = true to fail the build to check for duplicate entries.
  • See more details at Handling Duplicates Strategy.
  • Note: The default duplicatesStrategy is changed back to EXCLUDE in 9.0.1 release.
• BREAKING CHANGE: Align the behavior of ShadowTask.from with Gradle's AbstractCopyTask.from. (#​1233)
  In the previous versions, ShadowTask.from would always unzip the files before processing them, which caused serial
  issues that are hard to fix. Now it behaves like Gradle's AbstractCopyTask.from, which means it will not unzip
  the files, only copy the files as-is. If you still want to shadow the unzipped files, try out something like:

    tasks.shadowJar {
      // Unzip the files before pass them to `from` by using `zipTree`.
      from(zipTree(files('path/to/your/file.zip')))
    }

  or

    dependencies {
      // Add the files to `implementation` configuration, Shadow will unzip them automatically.
      implementation(files('path/to/your/file.zip'))
    }

• BREAKING CHANGE: Rename Transformer to ResourceTransformer. (#​1288)
  Aims to better align with the name org.apache.maven.plugins.shade.resource.ResourceTransformer.java
  and to distinguish itself from org.gradle.api.Transformer.java.
• BREAKING CHANGE: Mark DefaultInheritManifest as internal. (#​1303)
• BREAKING CHANGE: Polish ShadowSpec. (#​1307)
  • Return values of ShadowSpec functions are changed to Unit to avoid confusion.
  • ShadowSpec no longer extends CopySpec.
  • Overload relocate, transform and things for better usability in Kotlin.
• BREAKING CHANGE: Remove redundant types from function returning. (#​1308)
• BREAKING CHANGE: Rename ShadowJar's isEnableRelocation to enableAutoRelocation. (#​1541)
• BREAKING CHANGE: Some const values in ShadowBasePlugin and ShadowJavaPlugin are moved. (#​1589)
  You can find them in ShadowJar, ShadowApplicationPlugin, and ShadowJavaPlugin.
• Replace deprecated SelfResolvingDependency with FileCollectionDependency. (#​1114)
• Update start script templates. (#​1183)
• Mark more Transformers cacheable. (#​1210)
• Mark ShadowJar.dependencyFilter as @Input. (#​1206)
• Polish startShadowScripts task registering. (#​1216)
• Refactor file visiting logic in StreamAction, handle file unzipping via Project.zipTree. (#​1233)
• Migrate doc sites to MkDocs. (#​1302)
• runShadow no longer depends on installShadowDist. (#​1353)
• Move the group of ShadowJar from shadow to build. (#​1355)
• In-development snapshots are now published to the Central Portal Snapshots repository. (#​1414)
• Expose AbstractDependencyFilter from internal to public. (#​1538)
  You can access it via com.github.jengelman.gradle.plugins.shadow.tasks.DependencyFilter.AbstractDependencyFilter.
• Mark Action parameters as non-null. (#​1555)
• Use BufferedOutputStream when writing the Zip file to improve performance. (#​1580)

Fixed

• Fix single Log4j2Plugins.dat isn't included into fat jar. (#​1039)
• Fail builds if processing bad jars. (#​1146)
• Fix Log4j2PluginsCacheFileTransformer not working for merging Log4j2Plugins.dat files. (#​1175)
• Support overriding mainClass provided by JavaApplication. (#​1182)
• Fix ShadowJar not being successful after includes or excludes are changed. (#​1200)
• Honor DuplicatesStrategy. (#​1233)
• Honor unzipped jars via from. (#​1233)
• Fix the last modified time of shadowed directories. (#​1277)
• Fix relocation exclusion for file patterns like kotlin/kotlin.kotlin_builtins. (#​1313)
• Allow using file trees of JARs together with the configuration cache. (#​1441)

Removed

• BREAKING CHANGE: Some public getters and setters have been removed in SimpleRelocator. (#​1079)
• BREAKING CHANGE: Remove JavaJarExec, now use JavaExec directly for runShadow task. (#​1197)
• BREAKING CHANGE: ServiceFileTransformer.ServiceStream has been removed. (#​1218)
• BREAKING CHANGE: Remove KnowsTask as it's useless. (#​1236)
• BREAKING CHANGE: Remove BaseStreamAction. (#​1258)
• BREAKING CHANGE: Remove ShadowStats. (#​1264)
• BREAKING CHANGE: Remove ShadowCopyAction.ArchiveFileTreeElement and RelativeArchivePath. (#​1233)
• BREAKING CHANGE: Remove TransformerContext.getEntryTimestamp. (#​1245)
• BREAKING CHANGE: Reduce dependency and project overloads in DependencyFilter. (#​1328)
• BREAKING CHANGE: Remove ShadowSpec. (#​1560)
• BREAKING CHANGE: Remove Relocator.ROLE. (#​1563)
• BREAKING CHANGE: Remove deprecated ShadowExtension.component. (#​1586)

Migration Example

8.x

tasks.shadowJar {
  isEnableRelocation = true
  duplicatesStrategy = DuplicatesStrategy.EXCLUDE
  mergeServiceFiles()
  from("foo.jar")
}

9.x

tasks.shadowJar {
  // `isEnableRelocation` has been renamed to `enableAutoRelocation`.
  enableAutoRelocation = true

  // If you want to make `mergeServiceFiles` work, should set the `duplicatesStrategy` as `INCLUDE`.
  // `EXCLUDE` will exclude extra service files to be merged.
  duplicatesStrategy = DuplicatesStrategy.INCLUDE
  mergeServiceFiles()
  // If you leave `duplicatesStrategy` as `INCLUDE`, you can use the new `PreserveFirstFoundResourceTransformer`
  // to ensure that only the first found resource is included in the final JAR. Or duplicate entries will be bundled.
  transform<PreserveFirstFoundResourceTransformer>() {
    resources.add("META-INF/some-resource.txt")
  }
  // Optionally, you can enable the new `failOnDuplicateEntries` property to fail the build if there are duplicate entries.
  failOnDuplicateEntries = true

  // If you want to keep the `foo.jar` as-is (zipped), you can use the `from` method directly. This is different from the previous.
  from("foo.jar")
  // If you want to unzip the `foo.jar` before processing, you can use `zipTree` to unzip it.
  from(zipTree("foo.jar"))
}

If you used Shadow for merging service files, the following steps are recommended:

1. Make sure to leave duplicatesStrategy as INCLUDE or WARN.
2. Apply mergeServiceFiles or ServiceFileTransformer stuff as you did in your previous setup.
3. Diff the JARs from upgrading or not.
4. Remove the extra entries that are added by INCLUDE by filesMatching or PreserveFirstFoundResourceTransformer.
5. Diff the JARs again, and check that only the entries you want to preserve remain.
6. Optionally, if you want a stricter check for the shadowed JAR entries, enable failOnDuplicateEntries.

New Contributors

• @​KurdTt made their first contribution in #​1039
• @​SimonMarquis made their first contribution in #​1194
• @​andsel made their first contribution in #​1241
• @​vlsi made their first contribution in #​1490
• @​Jonathing made their first contribution in #​1422
• @​DreierF made their first contribution in #​1502
• @​gabrielfeo made their first contribution in #​1505

Full Changelog: GradleUp/shadow@8.3.9...9.0.0

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[otelbot-java-instrumentation]

🔧 The result from generateLicenseReport was committed to the PR branch.

[SylvainJuge]

Even after fixing a few API changes, we still have unexpected circular dependencies, for example:

Circular dependency between the following tasks:
:instrumentation:netty:netty-3.8:javaagent:shadowJar
+--- :instrumentation:netty:netty-4.0:javaagent:shadowJar
|    +--- :instrumentation:netty:netty-3.8:javaagent:shadowJar (*)
|    \--- :instrumentation:netty:netty-4.1:javaagent:shadowJar
|         +--- :instrumentation:netty:netty-3.8:javaagent:shadowJar (*)
|         \--- :instrumentation:netty:netty-4.0:javaagent:shadowJar (*)
\--- :instrumentation:netty:netty-4.1:javaagent:shadowJar (*)

(*) - details omitted (listed previously)

This is not specific to this netty instrumentation, even when removing those "circular" dependencies in netty we get similar ones with other instrumentations. Maybe something changed in the shadowJar task dependencies resolution with the new plugin version.

[otelbot-java-instrumentation]

🔧 The result from generateLicenseReport was committed to the PR branch.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[laurit]

Agent jar is roughly the same size as previously, but there are a bunch of files with slight changes in size. Checked one class and got the impression that previously class constant pools was rearranged while now that class matches what is under build/classes

[trask]

thanks @laurit!