[dependabot]

Bumps the gradle-dependencies group with 14 updates in the / directory:

Package	From	To
com.google.firebase:firebase-crashlytics-gradle	3.0.7	3.0.8
com.google.protobuf:protobuf-java	4.35.1	4.36.1
org.bitbucket.b_c:jose4j	0.9.6	0.9.7
com.google.guava:guava	33.6.0-android	33.7.1-android
com.google.firebase:firebase-bom	34.17.0	34.19.0
org.json:json	20260719	20260814
gradle-wrapper	9.7.0	9.7.1
androidx.compose:compose-bom	2026.08.00	2026.09.00
androidx.room:room-runtime	2.8.4	2.8.5
androidx.room:room-ktx	2.8.4	2.8.5
androidx.room:room-compiler	2.8.4	2.8.5
androidx.room:room-testing	2.8.4	2.8.5
net.zetetic:sqlcipher-android	4.17.0	4.19.0
com.google.devtools.ksp	2.3.11	2.3.12

Updates com.google.firebase:firebase-crashlytics-gradle from 3.0.7 to 3.0.8

Updates com.google.protobuf:protobuf-java from 4.35.1 to 4.36.1

Commits

• See full diff in compare view

Updates com.google.protobuf:protobuf-javalite from 4.35.1 to 4.36.1

Updates com.google.protobuf:protobuf-kotlin from 4.35.1 to 4.36.1

Updates com.google.protobuf:protobuf-kotlin-lite from 4.35.1 to 4.36.1

Updates org.bitbucket.b_c:jose4j from 0.9.6 to 0.9.7

Changelog

Sourced from [org.bitbucket.b_c:jose4j's changelog](https://bitbucket.org/b_c/jose4j/src/master/Release Notes.md).

jose4j-0.9.7 - September 9, 2026

• update test dependencies
• cap the size of numbers for better resource utilization in JSON processing (hat tip to Mike Read for the tip)
• fix some typos and other issues in javadoc and log messages
• updates for newer maven central publishing

Commits

• 756257e [maven-release-plugin] prepare for next development iteration
• 5db177b Look for Tag mismatch with no "!" b/c apparently maybe that changed
• 71a6650 Merged in strict-aud-validation (pull request #26)
• 05ce887 Compiler source and target to 1.8
• f7c6da8 Update slf4j, bouncycastle, and mockito dependencies
• 3ac5eb4 Merged in fix-comment-typos (pull request #27)
• a87874c Fix stated default in Get.setResponseBodySizeLimit javadoc
• 51bdce2 fix log message arg number missmatch
• 7d8c470 Another log message arg number mismatch with a different fix
• 908a55e cap the size of numbers for better resource utilization in JSON processing (h...
• Additional commits viewable in compare view

Updates com.google.guava:guava from 33.6.0-android to 33.7.1-android

Release notes

Sourced from com.google.guava:guava's releases.

33.7.1

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.7.1-jre</version>
  <!-- or, for Android: -->
  <version>33.7.1-android</version>
</dependency>

Jar files

• 33.7.1-jre.jar
• 33.7.1-android.jar

Guava requires one runtime dependency, which you can download here:

• failureaccess-1.0.3.jar

Javadoc

• 33.7.1-jre
• 33.7.1-android

JDiff

• 33.7.1-jre vs. 33.7.0-jre
• 33.7.1-android vs. 33.7.0-android
• 33.7.1-android vs. 33.7.1-jre

Changelog

Guava 33.7.1 removes the Multi-Release line from our jar manifest, fixing an issue under Java 9 and 10 that was introduced to guava-jre in version 33.7.0. Sorry for the trouble.

33.7.0

Newly introduced problem for Java 9 and Java 10 only

Guava 33.7.0 includes a Multi-Release line in its jar manifest, even though it is no longer a multi-release jar. This causes some problems with tools from Java 9 and Java 10. The issue is fixed in version 33.7.1. Sorry for the trouble.

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.7.0-jre</version>
  <!-- or, for Android: -->
</tr></table> 

... (truncated)

Commits

• See full diff in compare view

Updates com.google.firebase:firebase-bom from 34.17.0 to 34.19.0

Updates org.json:json from 20260719 to 20260814

Release notes

Sourced from org.json:json's releases.

20260814

Pull Request	Description
#1070	Fix XML.unescape for valid whitespace chars

Changelog

Sourced from org.json:json's changelog.

20260814 Fixes XML.unescape whitespace handling

Commits

• 6c14048 Merge pull request #1073 from stleary/pre-release-20260814
• 34efda6 pre-release-20260814 initial commit
• 22ab2fb Update jar file link in README
• 392a352 Fix formatting of the latest release jar file link
• b594a32 Merge pull request #1070 from dong0713/fix/xml-unescape-whitespace-control-chars
• 94854a1 Fix XML.unescape rejecting valid whitespace numeric character references
• See full diff in compare view

Updates gradle-wrapper from 9.7.0 to 9.7.1

Release notes

Sourced from gradle-wrapper's releases.

9.7.1

The Gradle team is excited to announce Gradle 9.7.1.

This is a patch release for 9.7.0. We recommend using 9.7.1 instead of 9.7.0.

Here are the highlights of 9.7.0 release:

• Isolated Projects graduates to incubating
• Broader Configuration Cache compatibility
• Resilient Sync helps you fix broken builds
• More source locations in problem reports

Read the Release Notes

We would like to thank the following community members for their contributions to this release of Gradle: Adam, Aman Gautam, Aman Kumar, Anton Dubrouski, Aurimas, gbhavya07, Josh Friend, nicklauslittle-gov, Pragati, project516, Qin Mi, Ravi, sk-reddy17, Suvrat Acharya, Yongshun Ye.

Upgrade instructions

Switch your build to use Gradle 9.7.1 by updating your wrapper:

./gradlew :wrapper --gradle-version=9.7.1 && ./gradlew :wrapper

See the Gradle 9.x upgrade guide to learn about deprecations, breaking changes and other considerations when upgrading.

For Java, Groovy, Kotlin and Android compatibility, see the full compatibility notes.

Reporting problems

If you find a problem with this release, please file a bug on GitHub Issues adhering to our issue guidelines. If you're not sure you're encountering a bug, please use the forum.

We hope you will build happiness with Gradle, and we look forward to your feedback via Twitter or on GitHub.

Commits

• 92f0512 update fixed issues for 9.7.1 (#38892)
• 820ee75 update fixed issues for 9.7.1
• 82c23f9 Fix annotation parameter ordering problem in KTS (#38878)
• ef11a72 Fix annotation parameter ordering issue
• bb0d8a9 Make relevant tests polyglot (run for multiple DSLs)
• 336e129 Update signing configuration (#38874)
• 4bdf0da Update signing configuration
• cd9b92c List issues resolved in 9.7.1 (#38839)
• 5f4e381 List issues resolved in 9.7.1
• 1e08ab5 Keep type-use annotations in extracted ABI classes (#38810)
• Additional commits viewable in compare view

Updates androidx.compose:compose-bom from 2026.08.00 to 2026.09.00

Updates androidx.room:room-runtime from 2.8.4 to 2.8.5

Updates androidx.room:room-ktx from 2.8.4 to 2.8.5

Updates androidx.room:room-compiler from 2.8.4 to 2.8.5

Updates androidx.room:room-testing from 2.8.4 to 2.8.5

Updates androidx.room:room-ktx from 2.8.4 to 2.8.5

Updates androidx.room:room-compiler from 2.8.4 to 2.8.5

Updates net.zetetic:sqlcipher-android from 4.17.0 to 4.19.0

Release notes

Sourced from net.zetetic:sqlcipher-android's releases.

v4.19.0

Full Changelog: sqlcipher/sqlcipher-android@v4.18.0...v4.19.0

v4.18.0

SQLCipher for Android v4.18.0 now includes:

• Support for Room 3
• Requires compileSdk 37

Full Changelog: sqlcipher/sqlcipher-android@v4.17.0...v4.18.0

Commits

• 9a5d685 Update README for 4.19.0 release
• 2a41f4f Bump version for 4.19.0 release
• 2d10561 Bump version tests for 4.19.0 release
• fc89d0c Add Room 3 integration sample to README
• cf07fd6 Update README
• e15752c Bump library version to 4.18.0
• 04d9948 Bump version tests to 4.18.0
• e5534be Add test to verify existing WAL flag in db is reflected correctly
• 748e37e Add instrumentation tests for SQLCipherDriver for Room3
• 078a05b sqlcipher-android internally maintains a connection pool
• Additional commits viewable in compare view

Updates androidx.room:room-testing from 2.8.4 to 2.8.5

Updates com.google.devtools.ksp from 2.3.11 to 2.3.12

Release notes

Sourced from com.google.devtools.ksp's releases.

2.3.12

What's Changed

Migrating Processors to Support Backing Fields

This release introduces support for explicit backing fields (#2873 ), which may now be returned by Resolver.getSymbolsWithAnnotation. To prevent breaking existing processors, new language features require an explicit opt-in.

Processors adapting to new features must opt in via both of the following steps simultaneously (failing to do both may lead to undefined behavior):

1. The processor should call the registerProcessorForNewFeatures function in SymbolProcessorEnvironment immediately when created (and only once). Example: AbstractTestProcessor.kt#L30
2. All implementations of KSVisitor should move to KSVisitorNext. If their processor code does not directly implement the interface but instead extends one of the KSP-provided visitors (such as KSTopDownVisitor), they should instead extend KSTopDownVisitor(enableNewFeatures = true) and override visitBackingField depending on their code and needs.

Bug Fixes

• Fix Resolver.getDeclarationsFromPackage returning incomplete declarations from KLibs in Kotlin Multiplatform (#2396)
• Fix KSP CLI process hanging indefinitely when a processor throws an unhandled exception (#3120)
• Fix implicit task dependency error between KSP and Android Lint in Android KMP (#3128)
• Fix NullPointerException by registering PluginProblemReporter as an application service (#3140)
• Do not mark companion objects as JAVA_STATIC in Resolver.effectiveJavaModifiers (#3125)
• Fix JAVA_STATIC modifier resolution for @​JvmStatic members in Resolver.effectiveJavaModifiers (#3124)
• Update minimum supported Android Gradle Plugin (AGP) version to 8.12.0 (#3149)

New Contributors

Thanks to @​KlyneChrysler, @​budindepunk, and everyone who reported bugs and participated in discussions!

Full Changelog: google/ksp@2.3.11...2.3.12

Commits

• a3c3859 Format Resolver file
• a614317 Fix grammatical errors in Resolver doc comments
• c19f255 Merge equal EXPECT NEXT and EXPECT CURRENT in javaBackingFieldUsedInKotlin
• d3df886 Add test for getting default annotation values in KMP
• 3bcac20 Mark testJavaBackingFieldUsedInKotlin as fixed
• e74bb5f Update expected test output in libOrigins
• c9b1d40 Use KSSyntheticJavaBackingFieldImpl in KSPropertyDeclarationImpl
• afefe15 Add KSSyntheticJavaBackingFieldImpl
• 2da07c1 Add test for missing synthetic Java fields
• 7033530 Fix visibility modifiers for Kotlin-based backing fields
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.