Bump com.gradleup.shadow from 9.4.1 to 9.6.1

[dependabot]

Bumps com.gradleup.shadow from 9.4.1 to 9.6.1.

Release notes

Sourced from com.gradleup.shadow's releases.

9.6.1

Changed

• Use GradleException for expected build failures. (#2113)

Fixed

• Preserve repeated lines in R8 rule files when using minimize { r8 { ... } }. (#2115)

9.6.0

Added

• Extract R8 rules from dependency JARs when using minimize { r8 { ... } }. (#2089)

Changed

• Rename ShadowDslMarker to ShadowDsl. (#2091)
• POTENTIALLY BREAKING: Apply @ShadowDsl to ShadowJar, ResourceTransformer, DependencyFilter, and Relocator. (#2090)
  This restricts nested DSL configuration blocks from implicitly calling outer receiver APIs in Kotlin script files.

Fixed

• Validate ZIP entry names to prevent Zip Slip path traversal.
• Avoid resolving unused R8 dependency. (#2101)

9.5.1

Fixed

• Fix eager calls for toolchainSpec in Kotlin DSL. (#2087)

9.5.0

[!NOTE] With the introduction of DuplicatesStrategy checking for transformers, you may see warnings like:

'META-INF/...kotlin_module' is matched by com.github.jengelman.gradle.plugins.shadow.transformers.KotlinModuleMetadataTransformer but its DuplicatesStrategy is EXCLUDE — duplicates may be silently dropped before the transformer processes them.

If you do not need Kotlin module metadata remapping, you can disable it:

tasks.shadowJar {
  @Suppress("DEPRECATION") // This flag will be disabled and removed in the next major version of Shadow.
  enableKotlinModuleRemapping = false
}

Added

• Check DuplicatesStrategy for merging transformers. (#2026)

... (truncated)

Changelog

Sourced from com.gradleup.shadow's changelog.

9.6.1 - 2026-07-22

Changed

• Use GradleException for expected build failures. (#2113)

Fixed

• Preserve repeated lines in R8 rule files when using minimize { r8 { ... } }. (#2115)

9.6.0 - 2026-07-16

Added

• Extract R8 rules from dependency JARs when using minimize { r8 { ... } }. (#2089)

Changed

• Rename ShadowDslMarker to ShadowDsl. (#2091)
• POTENTIALLY BREAKING: Apply @ShadowDsl to ShadowJar, ResourceTransformer, DependencyFilter, and Relocator. (#2090)
  This restricts nested DSL configuration blocks from implicitly calling outer receiver APIs in Kotlin script files.

Fixed

• Validate ZIP entry names to prevent Zip Slip path traversal.
• Avoid resolving unused R8 dependency. (#2101)

9.5.1 - 2026-07-06

Fixed

• Fix eager calls for toolchainSpec in Kotlin DSL. (#2087)

9.5.0 - 2026-07-06

[!NOTE] With the introduction of DuplicatesStrategy checking for transformers, you may see warnings like:

'META-INF/...kotlin_module' is matched by com.github.jengelman.gradle.plugins.shadow.transformers.KotlinModuleMetadataTransformer but its DuplicatesStrategy is EXCLUDE — duplicates may be silently dropped before the transformer processes them.

If you do not need Kotlin module metadata remapping, you can disable it:

tasks.shadowJar {
  @Suppress("DEPRECATION") // This flag will be disabled and removed in the next major version of Shadow.
  enableKotlinModuleRemapping = false
}

... (truncated)

Commits

• 185da5d Prepare version 9.6.1
• b309bc5 Extract addIncludedDependencies (#2116)
• 46b3544 Preserve repeated lines in R8 rule files (#2115)
• c0d4f0d Revert "Reland Tapmoc (#2111)"
• ff1809f Use GradleException for expected build failures (#2113)
• dc0ee64 Update plugin tapmoc to v0.4.2 (#2112)
• 398afcd Reland Tapmoc (#2111)
• 3ca69d5 Gradle 9.7.0-rc-1 (#2110)
• aaaacd2 Prepare next development version
• fb36668 Prepare version 9.6.0
• Additional commits viewable in compare view