Upgrade Kotlin to 2.4.20 with verified locks and compatible CodeQL

.github/workflows/security.yml

@@ -83,10 +83,23 @@ jobs:
           distribution: temurin
           java-version: "17"
       - uses: gradle/actions/wrapper-validation@ed408507eac070d1f99cc633dbcf757c94c7933a # v4
+      # CodeQL 2.27.0 cannot extract Kotlin 2.4.20. Pin the upstream nightly
+      # containing github/codeql#22404 until the recommended stable CLI is >=2.27.1.
+      # https://github.com/github/codeql/issues/22381#issuecomment-5620711447
+      - name: Download and verify the Kotlin-compatible CodeQL bundle
+        env:
+          CODEQL_BUNDLE_URL: https://github.com/dsp-testing/codeql-cli-nightlies/releases/download/codeql-bundle-20260913/codeql-bundle-java-linux64.tar.zst
+          CODEQL_BUNDLE_SHA256: 2f7435b506f062753a55e91e428df33bd0d9dfc8fed196114844f611334255de
+        run: |
+          bundle="$RUNNER_TEMP/codeql-bundle-java-linux64.tar.zst"
+          curl --fail --silent --show-error --location --retry 3 \
+            "$CODEQL_BUNDLE_URL" --output "$bundle"
+          printf '%s  %s\n' "$CODEQL_BUNDLE_SHA256" "$bundle" | sha256sum --check --strict
       - uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4
         with:
           languages: java-kotlin
           build-mode: manual
+          tools: ${{ runner.temp }}/codeql-bundle-java-linux64.tar.zst
       - name: Compile Java and Kotlin with CodeQL extraction
         run: ./gradlew --no-daemon --console=plain --no-build-cache clean assemble
       - uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4

CONTRIBUTING.md

@@ -16,6 +16,21 @@ lock files; CI restores them in locked mode. For Gradle changes, use
 consumer locks/checksums. Review both dependency versions and new checksums;
 ordinary CI must never generate or accept missing verification metadata.
 
+A Dependabot Gradle PR can update the version catalog without refreshing the
+producer or isolated consumer locks and checksums. Complete the same update
+sequence in that PR before merging; rebasing alone does not regenerate them.
+
+The Java/Kotlin CodeQL job temporarily pins the SHA-256-verified upstream
+`codeql-bundle-20260913` nightly because stable CLI 2.27.0 cannot extract Kotlin
+2.4.20. This is an unsupported prerelease scanner, used only in that analysis job;
+it is not a package or build dependency. See the
+[upstream compatibility issue](https://github.com/github/codeql/issues/22381#issuecomment-5620711447).
+Once the action's recommended stable CLI includes the fix in 2.27.1 or later,
+remove the bundle download and `tools` override and verify Java/Kotlin extraction
+with the pinned compiler. Do not downgrade Kotlin to work around the scanner:
+older Gradle plugins are affected by
+[GHSA-r937-wjx7-w2jp](https://github.com/advisories/GHSA-r937-wjx7-w2jp).
+
 Contributions to ArcForges-authored source, generated bindings, examples, tooling,
 configuration and documentation use Apache-2.0 under the root LICENSE. Add SPDX
 headers to authored code and preserve third-party licences and notices. Do not

README.md

@@ -28,7 +28,7 @@ compiler or source checkout. Kotlin/Native and iOS are outside this delivery.
 Install .NET SDK **10.0.400**, Node **24.21.0** (npm **11.19.0**) and Python
 **3.14.7**, JDK **17** and GnuPG (for the ephemeral signing test). Set `JAVA_HOME`
 to JDK 17. The checksum-pinned Gradle **9.3.0** wrapper is included; do not install
-a separate Gradle. Kotlin **2.3.21** is pinned in the version catalog. Version files in the root are authoritative. On Windows with fnm,
+a separate Gradle. Kotlin **2.4.20** is pinned in the version catalog. Version files in the root are authoritative. On Windows with fnm,
 select the pinned Node using `fnm use 24.21.0`; `fnm exec --using 24.21.0 --
 python eng/contracts.py restore` is an alternative if the shell is not configured.
 

docs/consuming.md

@@ -103,7 +103,7 @@ dependencies {
 `contracts-client` brings the matching `contracts-proto`, coroutine and gRPC
 runtime dependencies transitively. For serialization only, depend directly on
 `contracts-proto`. JARs contain generated code, not copies of those dependencies.
-Use JDK 17, JVM target 17 and Kotlin 2.3.21 or a compatible newer compiler. Android
+Use JDK 17, JVM target 17 and Kotlin 2.4.20 or a compatible newer compiler. Android
 apps configure their normal Java/desugaring toolchain and INTERNET permission.
 
 ```kotlin

gradle/libs.versions.toml

@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: Apache-2.0
 [versions]
-kotlin = "2.3.21"
+kotlin = "2.4.20"
 dokka = "2.2.0"
 protobuf = "4.36.1"
 grpc = "1.84.0"

src/public/kotlin/contracts-client/README.md

@@ -11,5 +11,5 @@ creation, TLS, authentication, deadlines, coroutine lifecycle and shutdown.
 No global channel, insecure production endpoint or authentication policy is
 installed by the generated library. This is native gRPC over HTTP/2.
 
-Use Java 17 and Kotlin 2.3.21 or a compatible newer compiler. See
+Use Java 17 and Kotlin 2.4.20 or a compatible newer compiler. See
 [installation and a complete call example](https://github.com/ArcForges/Contracts/blob/main/docs/consuming.md).

src/public/kotlin/contracts-client/gradle.lockfile

@@ -32,39 +32,49 @@ org.jetbrains.dokka:dokka-core:2.2.0=dokkaHtmlGeneratorRuntimeResolver~internal
 org.jetbrains.dokka:templating-plugin:2.2.0=dokkaHtmlGeneratorRuntimeResolver~internal,dokkaHtmlPluginIntransitiveResolver~internal
 org.jetbrains.kotlin:abi-tools-api:2.3.21=kotlinInternalAbiValidation
 org.jetbrains.kotlin:abi-tools:2.3.21=kotlinInternalAbiValidation
-org.jetbrains.kotlin:kotlin-build-tools-api:2.3.21=kotlinBuildToolsApiClasspath,kotlinCompilerClasspath
-org.jetbrains.kotlin:kotlin-build-tools-compat:2.3.21=kotlinBuildToolsApiClasspath,kotlinCompilerClasspath
-org.jetbrains.kotlin:kotlin-build-tools-cri-impl:2.3.21=kotlinBuildToolsApiClasspath,kotlinCompilerClasspath
-org.jetbrains.kotlin:kotlin-build-tools-impl:2.3.21=kotlinBuildToolsApiClasspath,kotlinCompilerClasspath
-org.jetbrains.kotlin:kotlin-compiler-embeddable:2.3.21=kotlinBuildToolsApiClasspath,kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
-org.jetbrains.kotlin:kotlin-compiler-runner:2.3.21=kotlinBuildToolsApiClasspath,kotlinCompilerClasspath
-org.jetbrains.kotlin:kotlin-daemon-client:2.3.21=kotlinBuildToolsApiClasspath,kotlinCompilerClasspath
-org.jetbrains.kotlin:kotlin-daemon-embeddable:2.3.21=kotlinBuildToolsApiClasspath,kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
+org.jetbrains.kotlin:kotlin-build-tools-api:2.4.0=kotlinAbiValidationCompatClasspath
+org.jetbrains.kotlin:kotlin-build-tools-api:2.4.20=kotlinBuildToolsApiClasspath,kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
+org.jetbrains.kotlin:kotlin-build-tools-compat:2.4.20=kotlinAbiValidationCompatClasspath,kotlinBuildToolsApiClasspath,kotlinCompilerClasspath
+org.jetbrains.kotlin:kotlin-build-tools-cri-impl:2.4.0=kotlinAbiValidationCompatClasspath
+org.jetbrains.kotlin:kotlin-build-tools-cri-impl:2.4.20=kotlinBuildToolsApiClasspath,kotlinCompilerClasspath
+org.jetbrains.kotlin:kotlin-build-tools-impl:2.4.0=kotlinAbiValidationCompatClasspath
+org.jetbrains.kotlin:kotlin-build-tools-impl:2.4.20=kotlinBuildToolsApiClasspath,kotlinCompilerClasspath
+org.jetbrains.kotlin:kotlin-compiler-embeddable:2.4.0=kotlinAbiValidationCompatClasspath
+org.jetbrains.kotlin:kotlin-compiler-embeddable:2.4.20=kotlinBuildToolsApiClasspath,kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
+org.jetbrains.kotlin:kotlin-compiler-runner:2.4.0=kotlinAbiValidationCompatClasspath
+org.jetbrains.kotlin:kotlin-compiler-runner:2.4.20=kotlinBuildToolsApiClasspath,kotlinCompilerClasspath
+org.jetbrains.kotlin:kotlin-daemon-client:2.4.0=kotlinAbiValidationCompatClasspath
+org.jetbrains.kotlin:kotlin-daemon-client:2.4.20=kotlinBuildToolsApiClasspath,kotlinCompilerClasspath
+org.jetbrains.kotlin:kotlin-daemon-embeddable:2.4.0=kotlinAbiValidationCompatClasspath
+org.jetbrains.kotlin:kotlin-daemon-embeddable:2.4.20=kotlinBuildToolsApiClasspath,kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
 org.jetbrains.kotlin:kotlin-klib-abi-reader:2.3.21=kotlinInternalAbiValidation
-org.jetbrains.kotlin:kotlin-klib-commonizer-embeddable:2.3.21=kotlinKlibCommonizerClasspath
+org.jetbrains.kotlin:kotlin-klib-commonizer-embeddable:2.4.20=kotlinKlibCommonizerClasspath
 org.jetbrains.kotlin:kotlin-metadata-jvm:2.3.21=kotlinInternalAbiValidation
-org.jetbrains.kotlin:kotlin-reflect:1.6.10=kotlinBuildToolsApiClasspath,kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
+org.jetbrains.kotlin:kotlin-reflect:1.6.10=kotlinAbiValidationCompatClasspath,kotlinBuildToolsApiClasspath,kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
 org.jetbrains.kotlin:kotlin-reflect:2.0.21=dokkaHtmlGeneratorRuntimeResolver~internal
-org.jetbrains.kotlin:kotlin-script-runtime:2.3.21=kotlinBuildToolsApiClasspath,kotlinCompilerClasspath,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest,kotlinKlibCommonizerClasspath
-org.jetbrains.kotlin:kotlin-scripting-common:2.3.21=kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest
-org.jetbrains.kotlin:kotlin-scripting-compiler-embeddable:2.3.21=kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest
-org.jetbrains.kotlin:kotlin-scripting-compiler-impl-embeddable:2.3.21=kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest
-org.jetbrains.kotlin:kotlin-scripting-jvm:2.3.21=kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest
+org.jetbrains.kotlin:kotlin-script-runtime:2.4.0=kotlinAbiValidationCompatClasspath
+org.jetbrains.kotlin:kotlin-script-runtime:2.4.20=kotlinBuildToolsApiClasspath,kotlinCompilerClasspath,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest,kotlinKlibCommonizerClasspath
+org.jetbrains.kotlin:kotlin-scripting-common:2.4.20=kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest
+org.jetbrains.kotlin:kotlin-scripting-compiler-embeddable:2.4.20=kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest
+org.jetbrains.kotlin:kotlin-scripting-compiler-impl-embeddable:2.4.20=kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest
+org.jetbrains.kotlin:kotlin-scripting-jvm:2.4.20=kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest
 org.jetbrains.kotlin:kotlin-stdlib-common:2.0.21=dokkaHtmlGeneratorRuntimeResolver~internal
 org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.8.20=dokkaHtmlGeneratorRuntimeResolver~internal
 org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.8.20=dokkaHtmlGeneratorRuntimeResolver~internal
 org.jetbrains.kotlin:kotlin-stdlib:2.0.21=dokkaHtmlGeneratorRuntimeResolver~internal
-org.jetbrains.kotlin:kotlin-stdlib:2.3.21=compileClasspath,kotlinBuildToolsApiClasspath,kotlinCompilerClasspath,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest,kotlinInternalAbiValidation,kotlinKlibCommonizerClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.jetbrains.kotlin:kotlin-tooling-core:2.3.21=kotlinBuildToolsApiClasspath,kotlinCompilerClasspath
+org.jetbrains.kotlin:kotlin-stdlib:2.3.21=kotlinInternalAbiValidation
+org.jetbrains.kotlin:kotlin-stdlib:2.4.0=kotlinAbiValidationCompatClasspath
+org.jetbrains.kotlin:kotlin-stdlib:2.4.20=compileClasspath,kotlinBuildToolsApiClasspath,kotlinCompilerClasspath,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest,kotlinKlibCommonizerClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+org.jetbrains.kotlin:kotlin-tooling-core:2.4.20=kotlinAbiValidationCompatClasspath,kotlinBuildToolsApiClasspath,kotlinCompilerClasspath
 org.jetbrains.kotlinx:kotlinx-coroutines-bom:1.11.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.jetbrains.kotlinx:kotlinx-coroutines-bom:1.7.3=dokkaHtmlGeneratorRuntimeResolver~internal
 org.jetbrains.kotlinx:kotlinx-coroutines-core-jvm:1.11.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.jetbrains.kotlinx:kotlinx-coroutines-core-jvm:1.7.3=dokkaHtmlGeneratorRuntimeResolver~internal
-org.jetbrains.kotlinx:kotlinx-coroutines-core-jvm:1.8.0=kotlinBuildToolsApiClasspath,kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
+org.jetbrains.kotlinx:kotlinx-coroutines-core-jvm:1.8.0=kotlinAbiValidationCompatClasspath,kotlinBuildToolsApiClasspath,kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
 org.jetbrains.kotlinx:kotlinx-coroutines-core:1.11.0=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.jetbrains.kotlinx:kotlinx-coroutines-core:1.7.3=dokkaHtmlGeneratorRuntimeResolver~internal
 org.jetbrains.kotlinx:kotlinx-html-jvm:0.9.1=dokkaHtmlGeneratorRuntimeResolver~internal
-org.jetbrains:annotations:13.0=kotlinBuildToolsApiClasspath,kotlinCompilerClasspath,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest,kotlinInternalAbiValidation,kotlinKlibCommonizerClasspath
+org.jetbrains:annotations:13.0=kotlinAbiValidationCompatClasspath,kotlinBuildToolsApiClasspath,kotlinCompilerClasspath,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest,kotlinInternalAbiValidation,kotlinKlibCommonizerClasspath
 org.jetbrains:annotations:23.0.0=compileClasspath,dokkaHtmlGeneratorRuntimeResolver~internal,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 org.jetbrains:markdown-jvm:0.7.3=dokkaHtmlGeneratorRuntimeResolver~internal
 org.jetbrains:markdown:0.7.3=dokkaHtmlGeneratorRuntimeResolver~internal

src/public/kotlin/contracts-proto/README.md

@@ -4,7 +4,7 @@
 messages, Kotlin message builders, the authored proto and its descriptor set.
 The current schema is the Hello World packaging example, not a product API.
 
-Use Java 17 and Kotlin 2.3.21 or a compatible newer Kotlin compiler. Android
+Use Java 17 and Kotlin 2.4.20 or a compatible newer Kotlin compiler. Android
 applications consume this ordinary JVM JAR; they do not run protoc. This package
 does not target Kotlin/Native or iOS. Runtime dependencies are declared in its
 POM and Gradle module metadata, not bundled into the JAR. Apache-2.0.