Bump to Gradle 9.5.1

[bric3]

What Does This Do

Move Gradle to 9.5.1.
Upgrade guide:

• To version 9.0.0
• Within versions 9.x

Checksums:

• https://gradle.org/release-checksums/
• https://services.gradle.org/distributions/gradle-9.5.1-bin.zip.sha256

Noteworthy Changes:

• Java 17+ required (up to Java 26) to run the Gradle daemon (toolchains still support Java 8+)
• Groovy 4.0 embedded (up from Groovy 3.0)
• Configuration Cache is now the preferred execution mode; Gradle prompts to enable it if no incompatibilities are found
• Wrapper supports specifying only a major/minor version (e.g. 9.x) resolved to the latest patch
• Task graph visualization via --task-graph flag — prints a tree of task dependencies without executing them
• New --console=colored mode — colors without rich progress bars, useful for CI
• Performance: up to 40% shorter time to first task execution in large builds
• Non-class-based testing support — Gradle can now discover and execute tests not defined in classes
• Automatic cleanup of daemon logs
• Task provenance in errors — quality-of-life for large multi-plugin builds, helps trace failures fast
• Windows ARM (ARM64/AArch64) support added
• Type-safe Kotlin accessors for precompiled Settings convention plugins (*.settings.gradle.kts) — IDE autocompletion and compile-time checking, matching the existing project-level experience

Detailed per version changes

• 9.0.0
• 9.1.0
• 9.2.0
• 9.3.0
• 9.4.0
• 9.5.0

9.0.0 (2025-07-31) — Major Release

• Java 17+ required, to run the Gradle daemon (toolchains still support Java 8+)
• Kotlin 2.2 embedded (language version 2.2); shift from Kotlin language 1.8 used in 8.x
• Groovy 4.0 embedded (up from Groovy 3.0)
• Semantic Versioning (SemVer) adopted — versions now follow MAJOR.MINOR.PATCH format
• Configuration Cache is now the preferred execution mode; Gradle prompts to enable it if no incompatibilities are found
• Graceful fallback from Configuration Cache on unsupported features (e.g. Maven/Ivy Publish plugins, Eclipse/IDEA plugins) instead of failing
• Configuration Cache report now includes more detailed errors (serialization issues, unsafe concurrent access, Groovy DSL closure captures)
• Kotlin DSL script compilation avoidance significantly improved — reduces unnecessary recompilation of .gradle.kts files
• JSpecify nullability annotations replace JSR-305 on the Gradle API
• New dependency graph root type allows detached configurations to resolve project dependencies
• Archive outputs are now reproducible by default
• Wrapper supports specifying only a major/minor version (e.g. 9.x) resolved to the latest patch
• Numerous deprecated APIs and behaviors removed — see the upgrade guide

---

9.1.0 (2025-09-18)

• Java 25 support added for daemon and toolchains
• Task graph visualization via --task-graph flag — prints a tree of task dependencies without executing them
• Enhanced Project Report now shows physical file-system locations alongside logical build paths
• gradle init for Kotlin projects now uses kotlin-test dependency (instead of kotlin-test-junit5) for flexible test framework selection
• Rich console shows an indicator when build output exceeds terminal height ("N lines not showing")
• New --console=colored mode — colors without rich progress bars, useful for CI
• Improved version conflict error messages — cleaner, more readable output for dependency resolution failures
• Configuration Cache read-only mode optimized for CI workflows
• Smarter cache entry reuse when command-line properties change
• Better Configuration Cache compatibility with customized JVM security policies
• Antlr, EAR, and Publishing plugin enhancements
• Fixed --dry-run behavior in composite builds

---

9.2.0 (2025-10-29)

• Windows ARM (ARM64/AArch64) support added
• Performance: up to 40% shorter time to first task execution in large builds (due to more efficient internal work graph construction); most significant on Configuration Cache hits
• 7–12% lower memory usage due to optimized internal data structures
• Daemon toolchain feature promoted to stable
• New PublishingExtension.getSoftwareComponentFactory() method — easier custom software component publishing without depending on Java plugins
• New provider-based methods on AdhocComponentWithVariants for lazy publishing configuration
• Better suggestions in error messages when dependency verification fails
• New task grouping for Antlr plugin

---

9.3.0 (2026-01-16)

• Redesigned HTML test reports — nested classes, parameterized tests, and suites now render in a proper hierarchy reflecting how tests are defined
• @Before/@After class/suite output now correctly associated with the right class/suite in JUnit 4, JUnit Jupiter, and TestNG
• Test Report Aggregation Plugin now supports overlapping test structures across subprojects
• New streaming API in TestKit for efficiently reading build output
• Problems API reports now rendered in console when using --warning-mode=all
• New AttributeContainer.named() convenience method for more concise attribute configuration
• Gradle's own distribution signatures now published for verification
• Dependency repositories can be disabled/skipped for more failure reasons
• Two security vulnerabilities fixed related to repositories with unknown/unresponsive hosts potentially exposing builds to malicious artifacts

---

9.4.0 (2026-03-04)

• Java 26 support added
• Non-class-based testing support — Gradle can now discover and execute tests not defined in classes (e.g. Cucumber .feature files, custom TestEngine formats); no workarounds needed
• Additional test data capture — JUnit Platform TestReporter data (attachments, key-value metadata) captured directly into HTML reports
• High-resolution progress bars with native terminal integration (e.g. Ghostty, iTerm2 ≥3.6.6)
• Redesigned Problems HTML report — collapsed trees, smarter hierarchy, alphabetical sorting
• PMD plugin now supports additional output formats
• Bearer token authentication for Gradle Wrapper downloads
• Automatic cleanup of daemon logs
• Configuration Cache now shows clearer attribution for closures and lambdas
• Plugin authoring: default plugin IDs added; stricter validation for published plugins
• New Tooling API models for IDE integration
• Granular control over Tooling API parallelism
• Task graph visualization (--task-graph) promoted to stable

---

9.5.0 / 9.5.1 (2026-04-28 / 2026-05-14)

• Task provenance in error messages and reports — failure messages now include which plugin/script registered the failing task; tasks report gains a --provenance flag
• Type-safe Kotlin accessors for precompiled Settings convention plugins (*.settings.gradle.kts) — IDE autocompletion and compile-time checking, matching the existing project-level experience
• Automatic retries for Wrapper downloads — configurable via retries and retryBackOffMs in gradle-wrapper.properties
• Domain Object Collections can now be locked by plugins to protect configured elements from modification by other plugins
• New environment variable to specify the network address for client-daemon communication (useful in restrictive network environments)
• gradle init gains a --target-dir option
• Improved Develocity integration
• Improved --help output
• Tooling API now exposes help and version information directly
• Improved diagnostics when an existing daemon is rejected due to JVM incompatibility (logs the specific reason at INFO level)
• 9.5.1 patch: fixed OOM regression from 9.4.1 → 9.5.0, Tooling API relative project directory issue, and missing docs

Gradle-9 blocking PRs

• Small Gradle Style tweaks #11306
• Upgrade protobuf Gradle plugin to 0.10.0 across all modules #11310
• Migrate cross-project test source sharing to java-test-fixtures for Gradle 9.5 compatibility #11367
• Add smoke-test plugin for nested Gradle builds #11405
• Remove unused Spring Boot plugin from kafkaschemaregistry #11406
• Switch spring-boot-2.7-webflux to the smoke-test plugin #11407
• Extract Spring Boot 2.x app source into nested-build subprojects #11408
• Migrate debugger-integration-tests cross-project test source sharing to java-test-fixtures for Gradle 9.5 compatibility #11416
• Convert wildfly earBuild tasks to the smoke-test plugin #11417
• Convert Spring Boot 3 / quarkus / armeria / vertx to smoke-test plugin #11421
• Convert test-published-dependencies to Gradle Kotlin DSL #11445
• Switch native smoke tests to the smoke-test plugin #11468
• Fix java9 module smoke test jlink on Gradle 9.5.1 #11489
• Allow Gradle smoke tests to run on Gradle 9.x #11490

This closes the quest started in #10402

Fixes #10402
Fixes #11272

Motivation

Use up-to-date build tools. This also showed that our build is using many old patterns and deprecated features that are either phased out, or already removed.

Additional Notes

Checked workflows

• update-gradle-dependencies.yaml (write dependency locks)
• run-system-tests.yaml
• analyze-changes.yaml

Checked distinct test-published-dependencies/ project.

Contributor Checklist

• Format the title according to the contribution guidelines
• Assign the type: and (comp: or inst:) labels in addition to any other useful labels
• Avoid using close, fix, or any linking keywords when referencing an issue
  Use solves instead, and assign the PR milestone to the issue
• Update the CODEOWNERS file on source file addition, migration, or deletion
• Update public documentation with any new configuration flags or behaviors

Jira ticket: [PROJ-IDENT]

Note: Once your PR is ready to merge, add it to the merge queue by commenting /merge. /merge -c cancels the queue request. /merge -f --reason "reason" skips all merge queue checks; please use this judiciously, as some checks do not run at the PR-level. For more information, see this doc.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 103fdb3d1a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[dd-octo-sts]

🟢 Java Benchmark SLOs — All performance SLOs passed

Suite	Status
Startup	🟢 pass

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results

Startup Time

Scenario	This PR	master	Change
insecure-bank / iast	14,724 ms	14,708 ms	+0.1%
insecure-bank / tracing	13,566 ms	13,746 ms	-1.3%
petclinic / appsec	16,380 ms	16,380 ms	+0.0%
petclinic / iast	16,611 ms	16,549 ms	+0.4%
petclinic / profiling	16,298 ms	16,535 ms	-1.4%
petclinic / tracing	15,872 ms	14,925 ms	+6.3%

Commit: 83ca3acc · CI Pipeline · Benchmarking Platform UI

---

Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.

[AlexeyKuznetsov-DD]

LGTM!
But let's bump Gradle just after next release.
Can't wait to test Gradle 9.6.0 and see if it will speedup our builds.

[AlexeyKuznetsov-DD]

nice!

[bric3]

But let's bump Gradle just after next release.

I agree.