build(deps): bring build, runtime, and test dependencies up to date for 2.0.0

.github/workflows/ci.yml

@@ -15,10 +15,10 @@ jobs:
     runs-on: ${{ github.repository == 'stainless-sdks/knock-java' && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v6
         with:
           distribution: temurin
           java-version: |
@@ -27,7 +27,7 @@ jobs:
           cache: gradle
 
       - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@v4
+        uses: gradle/actions/setup-gradle@v6
 
       - name: Run lints
         run: ./scripts/lint
@@ -36,10 +36,10 @@ jobs:
     name: test
     runs-on: ${{ github.repository == 'stainless-sdks/knock-java' && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v6
         with:
           distribution: temurin
           java-version: |
@@ -48,7 +48,7 @@ jobs:
           cache: gradle
 
       - name: Set up Gradle
-        uses: gradle/gradle-build-action@v2
+        uses: gradle/actions/setup-gradle@v6
 
       - name: Run tests
         run: ./scripts/test

.github/workflows/publish-sonatype.yml

@@ -14,19 +14,19 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up Java
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@v6
         with:
           distribution: temurin
           java-version: |
             8
-            17
+            21
           cache: gradle
 
       - name: Set up Gradle
-        uses: gradle/gradle-build-action@v2
+        uses: gradle/actions/setup-gradle@v6
 
       - name: Publish to Sonatype
         run: |-

.github/workflows/release-doctor.yml

@@ -12,7 +12,7 @@ jobs:
     if: github.repository == 'knocklabs/knock-java' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || startsWith(github.head_ref, 'release-please') || github.head_ref == 'next')
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Check release environment
         run: |

MIGRATION.md

@@ -102,6 +102,15 @@ BulkAddSubscriptionsParams.Subscription.builder()
 
 `ScheduleCreateParams.repeats()` returns `Optional<List<ScheduleRepeatRule>>`, because a schedule can be created with only `scheduled_at`.
 
+### Dependency updates
+
+The SDK still supports Java 8, but its dependencies have moved to their current major versions:
+
+- **OkHttp 5.** `knock-java-client-okhttp` (and so `knock-java`) now depends on OkHttp 5.5.0, via the `com.squareup.okhttp3:okhttp-jvm` artifact. OkHttp 5 is binary compatible with OkHttp 4 for most uses. If your build pins `com.squareup.okhttp3:okhttp` to 4.x, remove the pin or move it to 5.x. In Maven, depend on `okhttp-jvm` rather than `okhttp`, because the `okhttp` artifact is empty in OkHttp 5.
+- **Kotlin.** The SDK is compiled with language and API version 2.2 and depends on `kotlin-stdlib` 2.2 or later (OkHttp 5 already requires `kotlin-stdlib` 2.x). Java projects aren't affected beyond the newer transitive `kotlin-stdlib`. Kotlin projects need the Kotlin 2.1 compiler or later.
+- **Jackson.** The default Jackson version is 2.22.3. The minimum supported version is still 2.13.4.
+- **Apache HttpClient.** The transitive `httpclient5` and `httpcore5` versions are 5.6.4 and 5.4.4.
+
 ## New functionality
 
 - `workflowRecipientRuns()` with `list` and `get`

README.md

@@ -41,7 +41,7 @@ implementation("app.knock.api:knock-java:1.0.0")
 
 ## Requirements
 
-This library requires Java 8 or later.
+This library requires Java 8 or later. Kotlin projects need Kotlin 2.1 or later.
 
 ## Usage
 
@@ -323,7 +323,7 @@ $ export KNOCK_LOG=debug
 
 ## Jackson
 
-The SDK depends on [Jackson](https://github.com/FasterXML/jackson) for JSON serialization/deserialization. It is compatible with version 2.13.4 or higher, but depends on version 2.18.2 by default.
+The SDK depends on [Jackson](https://github.com/FasterXML/jackson) for JSON serialization/deserialization. It is compatible with version 2.13.4 or higher, but depends on version 2.22.3 by default.
 
 The SDK throws an exception if it detects an incompatible Jackson version at runtime (e.g. if the default version was overridden in your Maven or Gradle config).
 
@@ -426,7 +426,7 @@ The SDK consists of three artifacts:
 
 This structure allows replacing the SDK's default HTTP client without pulling in unnecessary dependencies.
 
-#### Customized [`OkHttpClient`](https://square.github.io/okhttp/3.x/okhttp/okhttp3/OkHttpClient.html)
+#### Customized [`OkHttpClient`](https://javadoc.io/doc/com.squareup.okhttp3/okhttp-jvm/latest/okhttp3/OkHttpClient.html)
 
 > [!TIP]
 > Try the available [network options](#network-options) before replacing the default client.

build.gradle.kts

@@ -1,5 +1,5 @@
 plugins {
-    id("org.jetbrains.dokka") version "2.0.0"
+    id("org.jetbrains.dokka-javadoc") version "2.2.0" apply false
 }
 
 repositories {
@@ -9,15 +9,23 @@ repositories {
 allprojects {
     group = "app.knock.api"
     version = "1.0.0" // x-release-please-version
-}
 
-subprojects {
-    apply(plugin = "org.jetbrains.dokka")
+    // Dokka's isolated build-tool classpaths otherwise resolve Jackson and jsoup versions with known
+    // vulnerabilities. This doesn't affect the SDK's published or test dependencies.
+    configurations.matching { it.name.startsWith("dokka") }.configureEach {
+        resolutionStrategy.eachDependency {
+            if (requested.group == "com.fasterxml.jackson" || requested.group.startsWith("com.fasterxml.jackson.")) {
+                // Jackson annotations uses a two-component version starting with 2.20.
+                useVersion(if (requested.name == "jackson-annotations") "2.22" else "2.22.3")
+                because("Dokka's build-only Jackson classpath must use a secure aligned release")
+            } else if (requested.group == "org.jsoup" && requested.name == "jsoup") {
+                useVersion("1.23.2")
+                because("Dokka's build-only jsoup classpath must use a secure release")
+            }
+        }
+    }
 }
 
-// Avoid race conditions between `dokkaJavadocCollector` and `dokkaJavadocJar` tasks
-tasks.named("dokkaJavadocCollector").configure {
-    subprojects.flatMap { it.tasks }
-        .filter { it.project.name != "knock-java" && it.name == "dokkaJavadocJar" }
-        .forEach { mustRunAfter(it) }
+subprojects {
+    apply(plugin = "org.jetbrains.dokka-javadoc")
 }

buildSrc/build.gradle.kts

@@ -1,7 +1,6 @@
 plugins {
     `kotlin-dsl`
-    kotlin("jvm") version "1.9.20"
-    id("com.vanniktech.maven.publish") version "0.28.0"
+    id("com.vanniktech.maven.publish") version "0.37.0"
 }
 
 repositories {
@@ -10,7 +9,7 @@ repositories {
 }
 
 dependencies {
-    implementation("com.diffplug.spotless:spotless-plugin-gradle:7.0.2")
-    implementation("org.jetbrains.kotlin:kotlin-gradle-plugin:1.9.20")
-    implementation("com.vanniktech:gradle-maven-publish-plugin:0.28.0")
+    implementation("com.diffplug.spotless:spotless-plugin-gradle:8.10.3")
+    implementation("org.jetbrains.kotlin:kotlin-gradle-plugin:2.4.20")
+    implementation("com.vanniktech:gradle-maven-publish-plugin:0.37.0")
 }

buildSrc/src/main/kotlin/knock.java.gradle.kts

@@ -33,6 +33,11 @@ tasks.withType<JavaCompile>().configureEach {
     options.release.set(8)
 }
 
+// Test-only dependencies (JUnit 6, WireMock 3) require a newer JVM. Published artifacts still target Java 8.
+tasks.named<JavaCompile>("compileTestJava") {
+    options.release.set(17)
+}
+
 tasks.named<Jar>("jar") {
     manifest {
         attributes(mapOf(

buildSrc/src/main/kotlin/knock.kotlin.gradle.kts

@@ -1,6 +1,8 @@
 import com.diffplug.gradle.spotless.SpotlessExtension
+import org.jetbrains.kotlin.gradle.dsl.JvmDefaultMode
 import org.jetbrains.kotlin.gradle.dsl.JvmTarget
 import org.jetbrains.kotlin.gradle.dsl.KotlinVersion
+import org.jetbrains.kotlin.gradle.tasks.KotlinCompile
 
 plugins {
     id("knock.java")
@@ -14,22 +16,31 @@ kotlin {
 
     compilerOptions {
         freeCompilerArgs = listOf(
-            "-Xjvm-default=all",
             "-Xjdk-release=1.8",
             // Suppress deprecation warnings because we may still reference and test deprecated members.
-            // TODO: Replace with `-Xsuppress-warning=DEPRECATION` once we use Kotlin compiler 2.1.0+.
-            "-nowarn",
+            "-Xwarning-level=DEPRECATION:disabled",
+            // Generated `validity()` implementations call `toInt()` on values that are already `Int`.
+            "-Xwarning-level=REDUNDANT_CALL_OF_CONVERSION_METHOD:disabled",
         )
         jvmTarget.set(JvmTarget.JVM_1_8)
-        languageVersion.set(KotlinVersion.KOTLIN_1_8)
-        apiVersion.set(KotlinVersion.KOTLIN_1_8)
-        coreLibrariesVersion = "1.8.0"
+        jvmDefault.set(JvmDefaultMode.NO_COMPATIBILITY)
+        languageVersion.set(KotlinVersion.KOTLIN_2_2)
+        apiVersion.set(KotlinVersion.KOTLIN_2_2)
+        coreLibrariesVersion = "2.2.0"
+    }
+}
+
+tasks.named<KotlinCompile>("compileTestKotlin") {
+    compilerOptions {
+        freeCompilerArgs = freeCompilerArgs.get().map { if (it == "-Xjdk-release=1.8") "-Xjdk-release=17" else it }
+        jvmTarget.set(JvmTarget.JVM_17)
     }
 }
 
 configure<SpotlessExtension> {
     kotlin {
-        ktfmt().kotlinlangStyle()
+        // Match the ktfmt version used to format generated code to avoid formatting churn.
+        ktfmt("0.61").kotlinlangStyle()
         toggleOffOn()
     }
 }

buildSrc/src/main/kotlin/knock.publish.gradle.kts

@@ -1,7 +1,8 @@
 import com.vanniktech.maven.publish.JavadocJar
 import com.vanniktech.maven.publish.KotlinJvm
 import com.vanniktech.maven.publish.MavenPublishBaseExtension
-import com.vanniktech.maven.publish.SonatypeHost
+import com.vanniktech.maven.publish.SourcesJar
+import org.gradle.plugins.signing.SigningExtension
 
 plugins {
     id("com.vanniktech.maven.publish")
@@ -12,19 +13,22 @@ repositories {
     mavenCentral()
 }
 
-extra["signingInMemoryKey"] = System.getenv("GPG_SIGNING_KEY")
-extra["signingInMemoryKeyId"] = System.getenv("GPG_SIGNING_KEY_ID")
-extra["signingInMemoryKeyPassword"] = System.getenv("GPG_SIGNING_PASSWORD")
-
 configure<MavenPublishBaseExtension> {
     signAllPublications()
-    publishToMavenCentral(SonatypeHost.CENTRAL_PORTAL)
+    configure<SigningExtension> {
+        useInMemoryPgpKeys(
+            System.getenv("GPG_SIGNING_KEY_ID"),
+            System.getenv("GPG_SIGNING_KEY"),
+            System.getenv("GPG_SIGNING_PASSWORD"),
+        )
+    }
+    publishToMavenCentral()
 
     coordinates(project.group.toString(), project.name, project.version.toString())
     configure(
         KotlinJvm(
-            javadocJar = JavadocJar.Dokka("dokkaJavadoc"),
-            sourcesJar = true,
+            javadocJar = JavadocJar.Dokka("dokkaGeneratePublicationJavadoc"),
+            sourcesJar = SourcesJar.Sources(),
         )
     )
 

gradle.properties

@@ -2,6 +2,8 @@ org.gradle.caching=true
 org.gradle.configuration-cache=true
 org.gradle.parallel=true
 org.gradle.daemon=false
+org.jetbrains.dokka.experimental.gradle.pluginMode=V2Enabled
+org.jetbrains.dokka.experimental.gradle.pluginMode.noWarn=true
 # These options improve our compilation and test performance. They are inherited by the Kotlin daemon.
 org.gradle.jvmargs=\
   -Xms1g \

gradle/wrapper/gradle-wrapper.properties

@@ -1,7 +1,9 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.12-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.8.0-bin.zip
 networkTimeout=10000
+retries=0
+retryBackOffMs=500
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists