Bump com.guardsquare:proguard-core from 9.0.7 to 9.0.8

[dependabot]

Bumps com.guardsquare:proguard-core from 9.0.7 to 9.0.8.

Release notes

Sourced from com.guardsquare:proguard-core's releases.

9.0.8

Improved

• Increase proguard.classfile.VersionConstants.MAX_SUPPORTED_VERSION to 64.65535 (Java 20 + preview enabled).
• Fix tracking of IdentifiedReferenceValue IDs.
• Add new Kotlin visitor SAM interfaces: KotlinClassVisitor, KotlinFileFacadeVisitor, KotlinMultiFileFacadeVisitor, KotlinMultiFilePartVisitor, KotlinSyntheticClassVisitor.

API changes

• JvmTransferRelation has been refactored to model IINC in a separate computeIncrement method.
• The ProcessingFlag.DONT_PROCESS_KOTLIN_MODULE value was changed from 0x00002000 to 0x00008000.
• Remove fromClassPool suffixes in CfaUtil methods.
• Refactor CodeLocation to only take the signature and offset into consideration.
• IdentifiedReferenceValue id field changed from int to Object.
• ParticularValueFactory.ReferenceFactory replaced by ParticularReferenceValueFactory.
• Add ValueFactory.createReferenceValue(String type, Clazz referencedClass, boolean mayBeExtension, boolean maybeNull, Clazz creationClass, Method creationMethod, int creationOffset) to allow creating references identified by their creation site.
• Add JvmCfaReferenceValueFactory to create references identified by the JvmCfaNode creation site.

Upgrade considerations

Identified and particular references can now be identified by any Object instead of a simple int. However, this means that code which compared the IDs may need to be modified. For example, the following code should be changed:

    public static boolean equal(IdentifiedReferenceValue a, IdentifiedReferenceValue b) {
        return a.id == b.id;
    }

It should use the equals method instead.

    public static boolean equal(IdentifiedReferenceValue a, IdentifiedReferenceValue b) {
        return a.id.equals(b.id);
    }

The ParticularReferenceValueFactory identifies references with integers by default:

ValueFactory valueFactory = new ParticularReferenceFactory(new ParticularReferenceValueFactory());
Value a = valueFactory.createReferenceValue("Ljava/lang/String;", clazz, false, false);
// a.id will be an integer.

Any Object can be used as an ID using the createReferenceValueForId method:

</tr></table> 

... (truncated)

Commits

• 16a0462 Use Gradle wrapper to run Sonar CI step (#88)
• 1b3e850 Allow Object type as IdentifiedReferenceValue IDs
• 21ddcbd Add value analysis test for recursion
• 93dc318 Always return a TypedReferenceValue when invoking a method returning a type...
• 7c38fb1 Simplify ProgramLocationDependentReachedSet add and remove operations
• 4797258 Fix calling of static string methods
• 8145331 Add %n to default log4j pattern
• 6f5ee53 Switch to StopJoinOperator in JvmValueBamCpaRun
• 0360bc9 Handle instance unknown values
• 917d158 Avoid creating unnsupported objects
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)