[dependabot]

Bumps the gradle group with 7 updates in the / directory:

Package	From	To
com.github.spotbugs	6.5.9	6.5.13
org.junit.jupiter:junit-jupiter-api	6.1.2	6.1.3
org.junit.jupiter:junit-jupiter-engine	6.1.2	6.1.3
org.junit.jupiter:junit-jupiter-params	6.1.2	6.1.3
org.junit.jupiter:junit-jupiter	6.1.2	6.1.3
software.amazon.smithy:smithy-model	1.72.1	1.74.1
jvm	2.4.10	2.4.21

Updates com.github.spotbugs from 6.5.9 to 6.5.13

Updates org.junit.jupiter:junit-jupiter-api from 6.1.2 to 6.1.3

Release notes

Sourced from org.junit.jupiter:junit-jupiter-api's releases.

JUnit 6.1.3 = Platform 6.1.3 + Jupiter 6.1.3 + Vintage 6.1.3

See Release Notes.

Full Changelog: junit-team/junit-framework@r6.1.2...r6.1.3

Commits

• f59f60d Release 6.1.3
• cd8ec92 Finalize 6.1.3 release notes
• c8729f2 Restore compatibility with GraalVM 25 (#5901)
• ddc9e74 Update graalvm/setup-graalvm action to v1.6.4 (#5959)
• fe2c52a Update plugin org.graalvm.buildtools.native to v1.1.7 (#5923)
• 62afc02 Delay GraalVM plugin updates for 3 days
• 0cc2902 Skip graalVmTest task if GraalVM env vars are not set
• f6bbfc5 Move GraalVM tests to separate test task (#5903)
• e87e052 Update plugin org.graalvm.buildtools.native to v1.1.6 (#5899)
• 1cd56df Update plugin org.graalvm.buildtools.native to v1.1.5 (#5880)
• Additional commits viewable in compare view

Updates org.junit.jupiter:junit-jupiter-engine from 6.1.2 to 6.1.3

Release notes

Sourced from org.junit.jupiter:junit-jupiter-engine's releases.

JUnit 6.1.3 = Platform 6.1.3 + Jupiter 6.1.3 + Vintage 6.1.3

See Release Notes.

Full Changelog: junit-team/junit-framework@r6.1.2...r6.1.3

Commits

• f59f60d Release 6.1.3
• cd8ec92 Finalize 6.1.3 release notes
• c8729f2 Restore compatibility with GraalVM 25 (#5901)
• ddc9e74 Update graalvm/setup-graalvm action to v1.6.4 (#5959)
• fe2c52a Update plugin org.graalvm.buildtools.native to v1.1.7 (#5923)
• 62afc02 Delay GraalVM plugin updates for 3 days
• 0cc2902 Skip graalVmTest task if GraalVM env vars are not set
• f6bbfc5 Move GraalVM tests to separate test task (#5903)
• e87e052 Update plugin org.graalvm.buildtools.native to v1.1.6 (#5899)
• 1cd56df Update plugin org.graalvm.buildtools.native to v1.1.5 (#5880)
• Additional commits viewable in compare view

Updates org.junit.jupiter:junit-jupiter-params from 6.1.2 to 6.1.3

Release notes

Sourced from org.junit.jupiter:junit-jupiter-params's releases.

JUnit 6.1.3 = Platform 6.1.3 + Jupiter 6.1.3 + Vintage 6.1.3

See Release Notes.

Full Changelog: junit-team/junit-framework@r6.1.2...r6.1.3

Commits

• f59f60d Release 6.1.3
• cd8ec92 Finalize 6.1.3 release notes
• c8729f2 Restore compatibility with GraalVM 25 (#5901)
• ddc9e74 Update graalvm/setup-graalvm action to v1.6.4 (#5959)
• fe2c52a Update plugin org.graalvm.buildtools.native to v1.1.7 (#5923)
• 62afc02 Delay GraalVM plugin updates for 3 days
• 0cc2902 Skip graalVmTest task if GraalVM env vars are not set
• f6bbfc5 Move GraalVM tests to separate test task (#5903)
• e87e052 Update plugin org.graalvm.buildtools.native to v1.1.6 (#5899)
• 1cd56df Update plugin org.graalvm.buildtools.native to v1.1.5 (#5880)
• Additional commits viewable in compare view

Updates org.junit.jupiter:junit-jupiter from 6.1.2 to 6.1.3

Release notes

Sourced from org.junit.jupiter:junit-jupiter's releases.

JUnit 6.1.3 = Platform 6.1.3 + Jupiter 6.1.3 + Vintage 6.1.3

See Release Notes.

Full Changelog: junit-team/junit-framework@r6.1.2...r6.1.3

Commits

• f59f60d Release 6.1.3
• cd8ec92 Finalize 6.1.3 release notes
• c8729f2 Restore compatibility with GraalVM 25 (#5901)
• ddc9e74 Update graalvm/setup-graalvm action to v1.6.4 (#5959)
• fe2c52a Update plugin org.graalvm.buildtools.native to v1.1.7 (#5923)
• 62afc02 Delay GraalVM plugin updates for 3 days
• 0cc2902 Skip graalVmTest task if GraalVM env vars are not set
• f6bbfc5 Move GraalVM tests to separate test task (#5903)
• e87e052 Update plugin org.graalvm.buildtools.native to v1.1.6 (#5899)
• 1cd56df Update plugin org.graalvm.buildtools.native to v1.1.5 (#5880)
• Additional commits viewable in compare view

Updates software.amazon.smithy:smithy-model from 1.72.1 to 1.74.1

Release notes

Sourced from software.amazon.smithy:smithy-model's releases.

Smithy CLI v1.74.1

1.74.1 (2026-10-13)

Bug Fixes

• Fixed the API Gateway EndpointConfiguration OpenAPI mapper to write the endpoint configuration extension to the correct location in the generated OpenAPI document. (#3304)
• Fixed the API Gateway @apiKeyRequired OpenAPI mapper to combine api_key with an operation's inherited or existing security requirements instead of replacing them, so authentication is no longer dropped when an API key is required. (#3296)
• Fixed node validation rejecting null values for timestamp members in a nullable context (#3248)
• Fixed AbstractCodeWriter state interception when interceptors push and pop writer states. (#3314)

Smithy CLI v1.74.0

1.74.0 (2026-09-24)

Features

• Added benchmark models for measuring the performance of serialization and deserialization (#3274)
• Expand unstable trait for preview usage. (#3277)
• Update stale error message for AddedRequiredMember (#3261)

Bug Fixes

• Fixed resource property and identifier bindings not being discovered through the output list member of list lifecycle operations, fixing ResourceOperationInputOutput errors for list-only resources. Collection operations can now bind properties and identifiers through list elements explicitly by applying @nestedProperties to an input or output member targeting a list of structures. (#2968) (#3269)
• Resolve endpoint rule-set components against the model's classloader (#3267)
• Fixed an issue where closure documentation was not being parsed. (#3276)
• Unmarked contentMediaType as unsupported in 3.1 OpenApi Spec (#3275)

Documentation

• Added client guidance for interceptors.
• Added client guidance for plugin composition, ordering, and discovery.

... (truncated)

Changelog

Sourced from software.amazon.smithy:smithy-model's changelog.

1.74.1 (2026-10-13)

Bug Fixes

• Fixed the API Gateway EndpointConfiguration OpenAPI mapper to write the endpoint configuration extension to the correct location in the generated OpenAPI document. (#3304)
• Fixed the API Gateway @apiKeyRequired OpenAPI mapper to combine api_key with an operation's inherited or existing security requirements instead of replacing them, so authentication is no longer dropped when an API key is required. (#3296)
• Fixed node validation rejecting null values for timestamp members in a nullable context (#3248)
• Fixed AbstractCodeWriter state interception when interceptors push and pop writer states. (#3314)

1.74.0 (2026-09-24)

Features

• Added benchmark models for measuring the performance of serialization and deserialization (#3274)
• Expand unstable trait for preview usage. (#3277)
• Update stale error message for AddedRequiredMember (#3261)
• Added the @createsResources, @putsResources, @deletesResources, @readsResources, and @updatesResources traits that declare which resources an operation affects for relationships that fall outside a resource's standard lifecycle. (#3273)

Bug Fixes

• Fixed resource property and identifier bindings not being discovered through the output list member of list lifecycle operations, fixing ResourceOperationInputOutput errors for list-only resources. Collection operations can now bind properties and identifiers through list elements explicitly by applying @nestedProperties to an input or output member targeting a list of structures. (#3269)
• Resolve endpoint rule-set components against the model's classloader (#3267)
• Fixed an issue where closure documentation was not being parsed. (#3276)
• Unmarked contentMediaType as unsupported in 3.1 OpenApi Spec (#3275)

Documentation

• Added client guidance for interceptors.

... (truncated)

Commits

• 1667ae5 Bump version to 1.74.1 (#3319)
• 2a61b43 Prevent reentrant AbstractCodeWriter state failures (#3314)
• ec88e02 skip additional validation for null nodes in a nullable context (#3248)
• bd0ed9e Fix API Gateway EndpointConfiguration OpenApi mapper to write to the right pl...
• 628bce6 Fix API Gateway ApiKeyRequired OpenApi mapper to append to service level secu...
• 7716837 Bump version to 1.74.0 (#3302)
• 8cbf3dc Downgrade validateElementMarkerMisuse to warning (#3303)
• 4fc94ba Add resource lifecycle traits (#3273)
• cf9c149 Expose notProperty membership from the index and avoid streams
• 0f20b3a Honor notProperty in element validation and report marker misuse
• Additional commits viewable in compare view

Updates jvm from 2.4.10 to 2.4.21

Release notes

Sourced from jvm's releases.

Kotlin 2.4.21

Changelog

Backend. Wasm

• KT-89267 K/Wasm: calling a (T) -> R lambda with an argument that isn't a T traps instead of throwing ClassCastException

JVM. Reflection

• KT-89280 NoSuchElementException in argumentsMakeSenseOnlyForMutableContainer for Java non-static inner class of generic outer class
• KT-80710 Reflection: change KCallable representation to avoid dependency on K1

JavaScript

• KT-89449 Kotlin/JS: Member names no longer minified in production
• KT-89363 KJS. Regular class with companion can't extend external class

Tools. Compiler plugins. Serialization

• KT-89275 Kotlin/Wasm: Invalid Wasm is emitted for a @Serializable generic class with a class upper bound

Tools. Gradle. Native

• KT-89285 SwiftPM import results in flooded log
• KT-86251 K/N: Flaky linkDebugTestLinuxX64 failure with "truncated or malformed archive" on libstdlib-cache.a

Tools. Scripts

• KT-89247 Kotlin Script: NoClassDefFoundError on 2nd execution with transitive dependency from imported script
• KT-89220 JSR-223: generic Java bindings break all subsequent eval() calls
• KT-88458 Audit closeable resource usage
• KT-88453 VirtualFileScriptSource.text leaks an unclosed file stream — script source file handle held until GC, blocks file deletion on Windows

Kotlin 2.4.21-RC

Changelog

Backend. Wasm

• KT-89267 K/Wasm: calling a (T) -> R lambda with an argument that isn't a T traps instead of throwing ClassCastException

JVM. Reflection

• KT-89280 NoSuchElementException in argumentsMakeSenseOnlyForMutableContainer for Java non-static inner class of generic outer class
• KT-80710 Reflection: change KCallable representation to avoid dependency on K1

JavaScript

• KT-89449 Kotlin/JS: Member names no longer minified in production
• KT-89363 KJS. Regular class with companion can't extend external class

... (truncated)

Changelog

Sourced from jvm's changelog.

2.4.21

Backend. Wasm

• KT-89267 K/Wasm: calling a (T) -> R lambda with an argument that isn't a T traps instead of throwing ClassCastException

JVM. Reflection

• KT-89280 NoSuchElementException in argumentsMakeSenseOnlyForMutableContainer for Java non-static inner class of generic outer class
• KT-80710 Reflection: change KCallable representation to avoid dependency on K1

JavaScript

• KT-89449 Kotlin/JS: Member names no longer minified in production
• KT-89363 KJS. Regular class with companion can't extend external class

Tools. Compiler plugins. Serialization

• KT-89275 Kotlin/Wasm: Invalid Wasm is emitted for a @Serializable generic class with a class upper bound

Tools. Gradle. Native

• KT-89285 SwiftPM import results in flooded log
• KT-86251 K/N: Flaky linkDebugTestLinuxX64 failure with "truncated or malformed archive" on libstdlib-cache.a

Tools. Scripts

• KT-89247 Kotlin Script: NoClassDefFoundError on 2nd execution with transitive dependency from imported script
• KT-89220 JSR-223: generic Java bindings break all subsequent eval() calls
• KT-88458 Audit closeable resource usage
• KT-88453 VirtualFileScriptSource.text leaks an unclosed file stream — script source file handle held until GC, blocks file deletion on Windows

2.4.20

Analysis API

• KT-86546 Check suspicious when over ConeKotlinType in ConeTypeCompatibilityChecker
• KT-85418 Implement an API for accessing deserialized file annotations in Analysis API
• KT-74448 K2. False positive MISSING_DEPENDENCY_SUPERCLASS in LinkedListTest.kt, kotlinx.coroutines
• KT-85856 containingSymbol of constructor property differs for local and non-local classes
• KT-65417 K2 IDE: KTOR false positive expect-actual matching error on enum class because of implicit clone() in non-JVM source sets

Analysis API. Code Compilation

• KT-76457 K2 IDE / KMP Debugger: KISEWA “Cannot compile a common source without a JVM counterpart” on evaluating inline fun from common module inside jvm

Analysis API. FIR

• KT-70552 No expects for actual

... (truncated)

Commits

• 9180ce6 Add changelog for 2.4.21-RC
• 851077b [Serialization] Copy type parameter bounds onto generated serializers (#8421)
• 1b6b624 [Wasm]: Generate a Kotlin-level cast for bridged lambda functions. (#8404)
• 3c223c2 Rrr/2.4.20/core docs (#8322)
• c681c2e [2.4.20] [KT-89285] Stop the xcodebuild logs being output by default (#8277)
• f0645d1 [2.4.20] [JS] Reorder CompilerConfiguration properties initialization (#8282)
• f507ecd [JS] Don't try to initialize an external class's companion object
• c60d7d8 Reflection: fix NoSuchElementException in ConvertFromJava.kt
• 05d1cde REPL: render correct reflected binding type
• 5acec47 Scripting: store collected dependencies recursively
• Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[joewyz]

@dependabot rebase