Bump byteBuddy from 1.18.10 to 1.18.15

[dependabot]

Bumps byteBuddy from 1.18.10 to 1.18.15.
Updates net.bytebuddy:byte-buddy from 1.18.10 to 1.18.15

Release notes

Sourced from net.bytebuddy:byte-buddy's releases.

Byte Buddy 1.18.14

• Avoid exposure of the agent argument on the command line of the process that is spawned for an external attachment.
• Avoid the resolution of symbolic links when the Gradle plugin deletes a folder recursively.
• Limit the nesting depth that is accepted when parsing a generic type signature to avoid an exhaustion of the stack for a malformed class file.
• Sign all deployed files using sigstore, in addition to the existing GPG signature.
• Validate entry names when the Android plugin retains a file to avoid the propagation of path traversals.

Byte Buddy 1.18.13

• Actually include the SBOM within the published artifacts.
• Avoid propagation of path traversals that are contained in jar files which are copied without transformation.
• Avoid repeated traversal of previously visited type hierarchies to improve performance.
• Correct Kotlin support of the Gradle plugin to redirect the classes directory of a source set while retaining support for legacy Gradle versions.
• Create Gradle tasks using Gradle's task registration API if available.

Byte Buddy 1.18.12

• Automatically support Kotlin in Gradle plugin.
• Add support for native attach on Windows for ARM64.
• Correct JNA injector which accidentally created on based on Unsafe.

Byte Buddy 1.18.11

• Add SBOM to published artifacts.
• Check for traversable paths injected into class files as a rather hypothetical attack vector.

Changelog

Sourced from net.bytebuddy:byte-buddy's changelog.

Byte Buddy release notes

14. September 2026: version 1.18.14

• Avoid exposure of the agent argument on the command line of the process that is spawned for an external attachment.
• Avoid the resolution of symbolic links when the Gradle plugin deletes a folder recursively.
• Limit the nesting depth that is accepted when parsing a generic type signature to avoid an exhaustion of the stack for a malformed class file.
• Sign all deployed files using sigstore, in addition to the existing GPG signature.
• Validate entry names when the Android plugin retains a file to avoid the propagation of path traversals.

2. September 2026: version 1.18.13

• Actually include the SBOM within the published artifacts.
• Avoid propagation of path traversals that are contained in jar files which are copied without transformation.
• Avoid repeated traversal of previously visited type hierarchies to improve performance.
• Correct Kotlin support of the Gradle plugin to redirect the classes directory of a source set while retaining support for legacy Gradle versions.
• Create Gradle tasks using Gradle's task registration API if available.

17. July 2026: version 1.18.12

• Automatically support Kotlin in Gradle plugin.
• Correct JNA injector which accidentally created on based on Unsafe.
• Support dynamic attach on Windows ARM64 by shipping a native attach_hotspot_windows library for win32-aarch64.

2. July 2026: version 1.18.11

• Add SBOM to published artifacts.
• Check for traversable paths injected into class files as a rather hypothetical attack vector.

Commits

• f2dffef [publish] Releasing Byte Buddy 1.18.15
• 7af339e [release] Release new version
• 74b23dc Update ASM.
• 807fb56 Remove the sigstore dry run from the build pipeline.
• 2efd25c Break the build on binary incompatibility again.
• 29a92ee Update internal Byte Buddy and release notes.
• b6ebdb3 [publish] Start next development iteration 1.18.15-SNAPSHOT
• 92846cb [publish] Releasing Byte Buddy 1.18.14
• a8a9f14 [release] Release new version
• b0fe006 Skip the signature creation for artifacts that are not deployed.
• Additional commits viewable in compare view

Updates net.bytebuddy:byte-buddy-agent from 1.18.10 to 1.18.15

Release notes

Sourced from net.bytebuddy:byte-buddy-agent's releases.

Byte Buddy 1.18.14

• Avoid exposure of the agent argument on the command line of the process that is spawned for an external attachment.
• Avoid the resolution of symbolic links when the Gradle plugin deletes a folder recursively.
• Limit the nesting depth that is accepted when parsing a generic type signature to avoid an exhaustion of the stack for a malformed class file.
• Sign all deployed files using sigstore, in addition to the existing GPG signature.
• Validate entry names when the Android plugin retains a file to avoid the propagation of path traversals.

Byte Buddy 1.18.13

• Actually include the SBOM within the published artifacts.
• Avoid propagation of path traversals that are contained in jar files which are copied without transformation.
• Avoid repeated traversal of previously visited type hierarchies to improve performance.
• Correct Kotlin support of the Gradle plugin to redirect the classes directory of a source set while retaining support for legacy Gradle versions.
• Create Gradle tasks using Gradle's task registration API if available.

Byte Buddy 1.18.12

• Automatically support Kotlin in Gradle plugin.
• Add support for native attach on Windows for ARM64.
• Correct JNA injector which accidentally created on based on Unsafe.

Byte Buddy 1.18.11

• Add SBOM to published artifacts.
• Check for traversable paths injected into class files as a rather hypothetical attack vector.

Changelog

Sourced from net.bytebuddy:byte-buddy-agent's changelog.

Byte Buddy release notes

14. September 2026: version 1.18.14

• Avoid exposure of the agent argument on the command line of the process that is spawned for an external attachment.
• Avoid the resolution of symbolic links when the Gradle plugin deletes a folder recursively.
• Limit the nesting depth that is accepted when parsing a generic type signature to avoid an exhaustion of the stack for a malformed class file.
• Sign all deployed files using sigstore, in addition to the existing GPG signature.
• Validate entry names when the Android plugin retains a file to avoid the propagation of path traversals.

2. September 2026: version 1.18.13

• Actually include the SBOM within the published artifacts.
• Avoid propagation of path traversals that are contained in jar files which are copied without transformation.
• Avoid repeated traversal of previously visited type hierarchies to improve performance.
• Correct Kotlin support of the Gradle plugin to redirect the classes directory of a source set while retaining support for legacy Gradle versions.
• Create Gradle tasks using Gradle's task registration API if available.

17. July 2026: version 1.18.12

• Automatically support Kotlin in Gradle plugin.
• Correct JNA injector which accidentally created on based on Unsafe.
• Support dynamic attach on Windows ARM64 by shipping a native attach_hotspot_windows library for win32-aarch64.

2. July 2026: version 1.18.11

• Add SBOM to published artifacts.
• Check for traversable paths injected into class files as a rather hypothetical attack vector.

Commits

• f2dffef [publish] Releasing Byte Buddy 1.18.15
• 7af339e [release] Release new version
• 74b23dc Update ASM.
• 807fb56 Remove the sigstore dry run from the build pipeline.
• 2efd25c Break the build on binary incompatibility again.
• 29a92ee Update internal Byte Buddy and release notes.
• b6ebdb3 [publish] Start next development iteration 1.18.15-SNAPSHOT
• 92846cb [publish] Releasing Byte Buddy 1.18.14
• a8a9f14 [release] Release new version
• b0fe006 Skip the signature creation for artifacts that are not deployed.
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud