[dependabot]

Bumps the maven-dependencies group with 11 updates in the / directory:

Package	From	To
gradle-wrapper	9.7.0	9.8.2
androidx.webkit:webkit	1.17.0	1.18.0
androidx.compose:compose-bom	2026.08.00	2026.09.00
io.coil-kt.coil3:coil-compose	3.5.0	3.6.3
com.squareup.okhttp3:okhttp	5.5.0	5.5.1
org.lsposed.libcxx:libcxx	29.0.14206865	30.0.16248370
com.android.application	9.3.1	9.4.1
com.google.devtools.ksp	2.3.11	2.3.12
org.lsposed.lsplugin.apksign	1.4	1.5
org.jetbrains.kotlin.android	2.4.10	2.4.21
org.jetbrains.kotlin.plugin.compose	2.4.10	2.4.21
org.jetbrains.kotlin.plugin.compose	2.4.10	2.4.21

Updates gradle-wrapper from 9.7.0 to 9.8.2

Release notes

Sourced from gradle-wrapper's releases.

9.8.2

The Gradle team is excited to announce Gradle 9.8.2.

Here are the highlights of this release:

• Java 27 support
• Maven mirror settings reuse
• Linked problem locations in build output

Read the Release Notes

We would like to thank the following community members for their contributions to this release of Gradle: Aman Gautam, Björn Kautler, Eng Zer Jun, Hashim Khan, Julian Krannich, KBS, Labh R Jethe, Mark Dodgson, Maxim, monkey, nataphon-ktsystems, Paul King, Qiu Tian, rg_sandesh, Roberto Perez Alcolea, Sean, Zongle Wang.

Upgrade instructions

Switch your build to use Gradle 9.8.2 by updating your wrapper:

./gradlew :wrapper --gradle-version=9.8.2 && ./gradlew :wrapper

See the Gradle 9.x upgrade guide to learn about deprecations, breaking changes and other considerations when upgrading.

For Java, Groovy, Kotlin and Android compatibility, see the full compatibility notes.

Reporting problems

If you find a problem with this release, please file a bug on GitHub Issues adhering to our issue guidelines. If you're not sure you're encountering a bug, please use the forum.

We hope you will build happiness with Gradle, and we look forward to your feedback via Twitter or on GitHub.

9.8.1

This is a patch release for Gradle 9.8.0. We recommend using 9.8.1 instead of 9.8.0.

This release addresses three high rated vulnerabilities:

... (truncated)

Commits

• 8de7bcf Speed up the AllVersionsCrossVersion flaky quarantine (#39494)
• 66805db Run all cross-version targets in flaky quarantine
• cdd4c8f Skip empty test tasks in the flaky test quarantine
• 6badb77 Split the AllVersionsCrossVersion quarantine across agents
• 1655e44 Prepare for 9.8.2 (#39492)
• 6702214 Prepare for 9.8.2
• 688c0c1 Fix false warning about unstable graph (#39479)
• 3601d4f Clarify selector reuse comments in SelectorState
• 6e836fd Fix false warning about unstable graph
• a0790e5 Fix hidden artifact cleanup pattern in CheckProject (#39451)
• Additional commits viewable in compare view

Updates androidx.webkit:webkit from 1.17.0 to 1.18.0

Updates androidx.compose:compose-bom from 2026.08.00 to 2026.09.00

Updates io.coil-kt.coil3:coil-compose from 3.5.0 to 3.6.3

Release notes

Sourced from io.coil-kt.coil3:coil-compose's releases.

3.6.3

See CHANGELOG.md.

3.6.2

See CHANGELOG.md.

3.6.1

See CHANGELOG.md.

3.6.0

See CHANGELOG.md.

Changelog

Sourced from io.coil-kt.coil3:coil-compose's changelog.

[3.6.3] - September 18, 2026

• Fix builds using Android Gradle Plugin 9.4.0 and R8 failing due to invalid characters in Kotlin module name metadata.

[3.6.2] - September 4, 2026

• Fix DeDupeConcurrentRequestStrategy hanging requests for a key if a waiting request is cancelled. (#3566)
• Fix a JS/WASM linkage error when using Compose Multiplatform 1.13. (#3568)

[3.6.1] - September 1, 2026

• Fix JS builds failing when ES modules are enabled. (#3558)

[3.6.0] - August 26, 2026

• New: Add support for loading blob: URLs (object URLs) on JS/WASM. (#3504)
• New: Add ImageRequest.Builder.allowPartialImage and ImageLoader.Builder.allowPartialImage to configure whether StaticImageDecoder on Android accepts partial images. This is enabled by default, which is the same behavior in previous Coil releases. (#3494)
• Fix AsyncImage crashing when measured with inverted constraints. (#3470)
• Fix Compose filterQuality not being applied to drawable-backed images, including GIFs. (#3469)
• Fix a JS/WASM image decoder memory leak. (#3503)
• Fix images failing to render with GenericViewTarget in R8 9.0+ optimized builds. (#3518)
• Use Runtime.maxMemory() to determine the maximum memory cache size on JVM instead of assuming 512 MB of available memory. (#3458)
• Bundle ProGuard rules with the non-Android JVM artifact. (#3476)
• Update the Android compile SDK to 37.
• Update Kotlin to 2.4.10.
• Update Compose to 1.12.0.
• Update Okio to 3.18.1.
• Update Skiko to 0.150.1.
• Update kotlinx-io-okio to 0.9.1.

Commits

• 29cae3b Prepare version 3.6.3.
• 0f371ca Remove invalid characters from Kotlin module name metadata. (#3587)
• 779ff1b Prepare version 3.6.2.
• b6818d3 Fix deduplicated request cancellation handling (#3566)
• 79ad576 Fix formatting.
• 4b14a54 Use InternalSkikoApi awaitSkiko directly in web worker decoding (#3568)
• 37e267b Migrate to AGP's new DSL. (#3567)
• 4f56bce Replace use of deprecated Gradle API. (#3565)
• 64f486b Update lint to v32.4.0 (#3564)
• 827faea Update dependency com.android.tools.build:gradle to v9.4.0 (#3563)
• Additional commits viewable in compare view

Updates com.squareup.okhttp3:okhttp from 5.5.0 to 5.5.1

Changelog

Sourced from com.squareup.okhttp3:okhttp's changelog.

Version 5.5.1

2026_10_22

• Fix: [Block 8 compromised eMudhra intermediate certificates][Mozilla_eMudhra]. Note that this update is not necessary for Android devices with Google Play Services as Google has issued an [automatic update][Google_eMudhra]. This change protects JVMs and AOSP devices that are exposed to the compromised certificates.

Commits

• be5151a Prepare for release 5.5.1.
• 6db9802 OkHttp 5.5.x: Blocklist 8 certificates for CVE-2026-111943 (#9805)
• See full diff in compare view

Updates org.lsposed.libcxx:libcxx from 29.0.14206865 to 30.0.16248370

Commits

• See full diff in compare view

Updates com.android.application from 9.3.1 to 9.4.1

Updates com.google.devtools.ksp from 2.3.11 to 2.3.12

Release notes

Sourced from com.google.devtools.ksp's releases.

2.3.12

What's Changed

Migrating Processors to Support Backing Fields

This release introduces support for explicit backing fields (#2873), which may now be returned by Resolver.getSymbolsWithAnnotation. To prevent breaking existing processors, new language features require an explicit opt-in.

More generally, the KSP API now explicitly models backing fields for properties. The following is an exhaustive list of functions in KSP API where processor may observe the change after opting in:

• Resolver.getSymbolsWithAnnotation: The function now returns a KSBackingField if the given annotation targeted a field. Previously, if a field were targeted, the function would return a KSProperty.
• Resolver.effectiveJavaModifiers: The function returns fewer modifiers for a KSPropertyDeclaration if it has a backing field, since most of the JVM-specific annotations apply to the backing field. If you are interested in the JVM modifiers, you should call the function with the KSBackingField obtained from the property instead.

Additionally, KSP now models Java fields as properties that always have backing fields. Some of the modifiers now apply to the backing field instead.

Processors adapting to new features must opt in via both of the following steps simultaneously (failing to do both may lead to undefined behavior):

1. The processor should call the registerProcessorForNewFeatures function in SymbolProcessorEnvironment immediately when created (and only once). Example: AbstractTestProcessor.kt#L30
2. All implementations of KSVisitor should move to KSVisitorNext. If their processor code does not directly implement the interface but instead extends one of the KSP-provided visitors (such as KSTopDownVisitor), they should instead extend KSTopDownVisitor(enableNewFeatures = true) and override visitBackingField depending on their code and needs.

Let us know if you run into unexpected behavior!

Bug Fixes

• Fix Resolver.getDeclarationsFromPackage returning incomplete declarations from KLibs in Kotlin Multiplatform (#2396)
• Fix KSP CLI process hanging indefinitely when a processor throws an unhandled exception (#3120)
• Fix implicit task dependency error between KSP and Android Lint in Android KMP (#3128)
• Fix NullPointerException by registering PluginProblemReporter as an application service (#3140)
• Do not mark companion objects as JAVA_STATIC in Resolver.effectiveJavaModifiers (#3125)
• Fix JAVA_STATIC modifier resolution for @​JvmStatic members in Resolver.effectiveJavaModifiers (#3124)
• Update minimum supported Android Gradle Plugin (AGP) version to 8.12.0 (#3149)

New Contributors

Thanks to @​KlyneChrysler, @​budindepunk, and everyone who reported bugs and participated in discussions!

Full Changelog: google/ksp@2.3.11...2.3.12

Commits

• a3c3859 Format Resolver file
• a614317 Fix grammatical errors in Resolver doc comments
• c19f255 Merge equal EXPECT NEXT and EXPECT CURRENT in javaBackingFieldUsedInKotlin
• d3df886 Add test for getting default annotation values in KMP
• 3bcac20 Mark testJavaBackingFieldUsedInKotlin as fixed
• e74bb5f Update expected test output in libOrigins
• c9b1d40 Use KSSyntheticJavaBackingFieldImpl in KSPropertyDeclarationImpl
• afefe15 Add KSSyntheticJavaBackingFieldImpl
• 2da07c1 Add test for missing synthetic Java fields
• 7033530 Fix visibility modifiers for Kotlin-based backing fields
• Additional commits viewable in compare view

Updates org.lsposed.lsplugin.apksign from 1.4 to 1.5

Commits

• See full diff in compare view

Updates org.jetbrains.kotlin.android from 2.4.10 to 2.4.21

Updates org.jetbrains.kotlin.plugin.compose from 2.4.10 to 2.4.21

Updates org.jetbrains.kotlin.plugin.compose from 2.4.10 to 2.4.21

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions