Update dependency com.github.ben-manes:gradle-versions-plugin to v0.64.0 - #23

v0.64.0

• Add a problems output format, which reports each outdated dependency to Gradle's Problems API (#​974, #​1126)
• Warn when an outputFormatter name isn't one of the built-in formatters, where the plain text report was written without a warning (#​1130, #​1131)
• Leave the log4j-core constraint that Gradle adds to every script classpath, and to the Scala plugin's zinc configuration, out of the report (#​1128, #​1129)
• Run the build workflow on the tag before publishing a release (#​1125)

[!NOTE]

• The problems format needs Gradle 8.13 or later. On an earlier Gradle it is skipped, with a message at the info log level.
• The problems are printed on the console under --warning-mode all from Gradle 9.3. On an earlier Gradle they are listed only in build/reports/problems/problems-report.html.
• A log4j-core constraint declared in the build with the same versions as Gradle's, on a script classpath or on zinc, is left out as well.

v0.63.1

• Report a constraint declared without a version at the version resolved for it, where it was listed as failing with Could not find <group>:<module>:none. (#​1122, #​1123)

v0.63.0

• Print the latest patch and minor versions in each row, before the latest version, and add them to the JSON and XML reports as available.patch and available.minor (#​69, #​841, #​1118)
• Leave the versions Gradle sets for its embedded Kotlin out of the report, with a checkEmbeddedKotlin property to report them (#​1110, #​1111)
• Time out each request of the Gradle update check after 15s, where a request that got no response took about four hours (#​1119, #​1120)
• Drop OkHttp from the plugin's dependencies, and bump Moshi to 1.15.2 so that Okio is past CVE-2023-3635 (#​1120)
• Stop publishing kotlin-bom and kotlin-stdlib as dependencies of the plugin, so the Kotlin modules on a build script classpath are no longer raised above an older Kotlin Gradle Plugin, or above a strict version pinned by kotlin-dsl (#​962, #​1112, #​1113)
• Compile the plugin at Kotlin language version 2.0, so build logic on Gradle 8.4 can use it (#​1108, #​1109)
• Log each configuration that filterConfigurations rejects at info level (#​1106)
• Write the Kotlin Gradle Plugin and Android Gradle Plugin filters in the README for filterDeclaredConfigurations, so they also apply to the entries merged from included builds (#​1104)
• Build on Gradle 9.7.1, and run the test suite on every supported JDK (#​1105)
• Improve build times (#​1107)

[!IMPORTANT]

• A row in the plain text report can now include the latest patch and minor versions between the current version and the latest one, as [1.10.18 -> 1.10.19 -> 1.11.5 -> 2.1.6]. The versions in a row are not labeled, so a tool that reads a version by its position in the row has to read available from the JSON or XML report instead.
• OkHttp is no longer on the buildscript classpath of a build that applies the plugin. Where OkHttp classes are used in a build script, OkHttp now has to be declared on its buildscript classpath.

See Migrating from prior versions.

[!TIP]

• The Kotlin Gradle Plugin can be applied at 1.9 again, so a build pinned to v0.51.0 for the Kotlin 1.x note in the v0.52.0 release notes can upgrade.
• The Kotlin Gradle Plugin and Android Gradle Plugin filters in the README are now written for filterDeclaredConfigurations. A rule set on the task that writes the report is applied to the entries merged from included builds as well, but filterConfigurations has to be declared in each build. kotlinBouncyCastleConfiguration was added to the Kotlin set, since it is filled in a project that applies the signing plugin.

[!NOTE]

• kotlin-stdlib, kotlin-reflect and kotlin-scripting-compiler-embeddable are no longer printed at the embedded Kotlin version where they are added by kotlin-dsl or embedded-kotlin, and neither are the kotlin-dsl plugins at the version paired with the running Gradle on a buildscript or settings classpath. The number left out is printed at the end of the plain text report. Set checkEmbeddedKotlin = true to print them, or pass --check-embedded-kotlin for a single run.
• The latest patch and minor versions are resolved as the latest version is, so a rejectVersionIf filter or componentSelection rule is called again for each of them.
• Credentials from a registered java.net.Authenticator are now sent with the Gradle update check to a host that responds with a 401, or a proxy that responds with a 407. A redirect to another scheme is no longer followed.

v0.54.0

• Workaround for issues caused by plugins adding dynamic configurations (#​985, #​984, #​979, #​968, #​966, #​930)

v0.53.0

• Fails the task in Gradle 9+ if run without disabling parallel project execution
• Fixes to the html report rendering (#​933, #​946)

[!NOTE]

In Gradle 9.0 and above, the dependencyUpdates task should be run with the --no-parallel flag

v0.52.0

• Replace deprecated api usage for Gradle 9.0 compatibility (#​856; thanks @​jvandort)
• Resolve Kotlin 2.0 incompatibility (#​907; thanks @​elevenfive)

[!NOTE]
Kotlin 1.x is no longer supported

This plugin now uses Kotlin 2.x for compatibility. Unfortunately Kotlin lacks the ability to target older versions for binary compatibility (as in Java's --release option) and Gradle does not fully isolate plugins from conflicting dependencies. Therefore, this plugin is incompatible for projects using the Kotlin 1.x gradle plugin due to hidden compiler injected byte code. Please use the previous release for Kotlin 1.x projects (#​929).

v0.51.0

• Ensure Kotlin dependencies are properly handled when not forced (#​823, #​824, #​825; thanks @​tresat)

v0.50.0

Fixed xml report "Unrecognized configuration feature: indent-number" (#​818)

v0.49.0

Replaced xstreams with javax.xml for Gradle 8.4 compatibility (#​814)

If you still have a legacy xml provider listed in your buildEnvironment dependency tree, such as old version of xerces, then you can force the default provider to OpenJDK's by adding the following to your gradle.properties.

systemProp.javax.xml.parsers.SAXParserFactory=com.sun.org.apache.xerces.internal.jaxp.SAXParserFactoryImpl
systemProp.javax.xml.transform.TransformerFactory=com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl
systemProp.javax.xml.parsers.DocumentBuilderFactory=com.sun.org.apache.xerces.internal.jaxp.DocumentBuilderFactoryImpl

v0.48.0

Allow the gradle versions api url to be customized to support restricted environments (#​807)

v0.47.0

What's Changed

• Avoid configuring dependencyUpdates task by @​dreis2211 in #​736
• Update dependabot.yml by @​jaredsburrows in #​739
• Bump com.squareup.okhttp3:okhttp from 4.9.3 to 4.10.0 by @​dependabot in #​740
• Bump org.jetbrains.dokka from 1.6.21 to 1.8.10 by @​dependabot in #​744
• Bump org.jetbrains.kotlin.jvm from 1.6.21 to 1.8.10 by @​dependabot in #​741
• gradle 8 by @​jaredsburrows in #​745
• Fix broken Sonatype links in HTML reports by @​marcosalis in #​750
• Bump com.thoughtworks.xstream:xstream from 1.4.19 to 1.4.20 by @​dependabot in #​751
• Bump org.jetbrains.kotlin:kotlin-reflect from 1.6.21 to 1.8.10 by @​dependabot in #​752
• Bump actions/setup-java from 3.10.0 to 3.11.0 by @​dependabot in #​760
• Bump org.jetbrains.kotlin.jvm from 1.8.10 to 1.8.20 by @​dependabot in #​762
• Bump org.jetbrains.kotlin:kotlin-stdlib-jdk8 from 1.6.21 to 1.8.20 by @​dependabot in #​763
• Bump org.jetbrains.kotlin:kotlin-reflect from 1.8.10 to 1.8.20 by @​dependabot in #​767
• Fix inherited collection to not be always empty by @​tresat in #​768
• Replace deprecated toUpperCase() kotlin.text calls by @​smelfungus in #​779
• Bump org.jetbrains.kotlin:kotlin-stdlib-jdk8 from 1.8.20 to 1.8.21 by @​dependabot in #​775
• Bump com.squareup.okhttp3:okhttp from 4.10.0 to 4.11.0 by @​dependabot in #​770
• Allow filtering configurations by @​bh-tt in #​785

New Contributors

• @​dreis2211 made their first contribution in #​736
• @​marcosalis made their first contribution in #​750
• @​tresat made their first contribution in #​768
• @​smelfungus made their first contribution in #​779
• @​bh-tt made their first contribution in #​785

Full Changelog: ben-manes/gradle-versions-plugin@v0.46.0...v0.47.0

v0.46.0

• Ignore constraints of own projects (#​724)
• Set the JVM attribute on the copied configuration (#​727)
• Do not use textual 'null' for dependencies without group (#​731)

v0.45.0

• Fix HTML report structure (#​715)
• Only resolve resolvable configurations (#​721)

v0.44.0

• report results should be modifiable (#​704)
• trim whitespace between output format options (#​703)

v0.43.0

• Ignore failOnDynamicVersions() to fetch latest versions (#​593)
• Requires Gradle 7.0 baseline (earlier plugin versions can be used otherwise)

This release migrated the plugin from Groovy to Kotlin, and therefore there may be some slight regressions. Please let us know if you find any problems.