build(deps): bump jvm in / - #930
Conversation
Bumps [jvm](https://github.com/JetBrains/kotlin) in `/` from 1.9.20 to 2.4.10. Updates `jvm` from 1.9.20 to 2.4.10 - [Release notes](https://github.com/JetBrains/kotlin/releases) - [Changelog](https://github.com/JetBrains/kotlin/blob/master/ChangeLog.md) - [Commits](JetBrains/kotlin@v1.9.20...v2.4.10) --- updated-dependencies: - dependency-name: jvm dependency-version: 2.4.10 dependency-type: direct:production update-type: version-update:semver-major dependency-group: gradle ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
OkTest Summary❌ Failed for Java SDK PR #930. SDK merge ( |
Castiron custom code✅ No new custom-code files detected. 53 mixed files remain; 0 existing customizations changed. Compared 53 existing customizations unchanged
13 more in the full report. A changed generated baseline means this report cannot reliably identify which handwritten lines changed. Inspect the custom-code diffDownload the exact patch produced by this run (requires repository access): gh run download 32711454991 --repo openai/openai-java \
--name castiron-custom-code-32711454991-1 --dir /tmp/castiron-custom-code-32711454991-1
git apply --stat /tmp/castiron-custom-code-32711454991-1/custom-code.patch
cat /tmp/castiron-custom-code-32711454991-1/custom-code.patchOr reproduce it from an SDK checkout containing the vendored reporter: git fetch --no-tags origin 5f499c32eb4357e2552d9f97697d63eddbc6069b 91bdef84ea332f03e4f0ba25d9cb3cc6e8f16909
python3 scripts/castiron/custom_code_report.py report \
--base 5f499c32eb4357e2552d9f97697d63eddbc6069b \
--head 91bdef84ea332f03e4f0ba25d9cb3cc6e8f16909 --fetch --require-head-hash --public \
--out /tmp/castiron-custom-code-91bdef84ea33
cat /tmp/castiron-custom-code-91bdef84ea33/custom-code.patchThis is the current full custom patch for mixed files, not an attribution of only the handwritten lines changed by this PR. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 91bdef84ea
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| plugins { | ||
| `kotlin-dsl` | ||
| kotlin("jvm") version "1.9.20" | ||
| kotlin("jvm") version "2.4.10" |
There was a problem hiding this comment.
This upgrades only the plugin used to compile buildSrc; the implementation("org.jetbrains.kotlin:kotlin-gradle-plugin:1.9.20") dependency still supplies Kotlin 1.9.20 to the openai.kotlin convention plugin used by SDK subprojects. Consequently every build now loads two KGP versions while the production compiler remains unchanged. This also contradicts the upgrade procedure in SECURITY.md:96-104, which identifies 2.4.10 as below the first fixed release and requires upgrading both declarations together after compatibility review. Revert this partial bump, or update both declarations to an eligible version and run the prescribed compatibility matrices.
AGENTS.md reference: AGENTS.md:L34-L36
Useful? React with 👍 / 👎.
jbeckwith-oai
left a comment
jbeckwith-oai
left a comment
There was a problem hiding this comment.
This is a breaking, partial Kotlin toolchain upgrade and must not auto-merge. It changes only the kotlin(jvm) plugin declaration from 1.9.20 to 2.4.10 while the kotlin-gradle-plugin implementation dependency remains 1.9.20. Exact-head CI fails during buildSrc compilation: Kotlin 2.4 rejects the existing language/API version 1.8, and the Gradle 8.12 kotlin-dsl plugin reports incompatible embedded Kotlin versions. Lint, build, dependency submission, and version-policy checks fail; tests and API/runtime compatibility checks never run. Keep Kotlin 1.9.20, or prepare a coordinated migration of both plugin declarations, Gradle/embedded Kotlin compatibility, language/API policy, published consumer compatibility, and the Java 8 runtime matrix. Kotlin 2.4.10 also remains below the documented first patched version 2.4.20 for CVE-2026-53914.
1 participant
Bumps jvm in
/from 1.9.20 to 2.4.10.Updates
jvmfrom 1.9.20 to 2.4.10Release notes
Sourced from jvm's releases.
... (truncated)
Changelog
Sourced from jvm's changelog.
... (truncated)
Commits
5687445Add Changelog for 2.4.10-RC2ba30392[Wasm] Support regenerate unchanged modules flag on KGP6307e73[Wasm] Implement Xwasm-IC-generate-unchanged-modules flag39d7aeeAdd ChangeLog for 2.4.10-RC2a2956be[Gradle] Update karma.conf.js to use 'require(...)' instead plain strings9b1361c[Gradle] KT-87223: Updated regression testa4c153a[Gradle] KT-87223: Fix toochain to 2.4.0 for abiValidation compat configbc04b90Add ChangeLog for 2.4.10-RCbbcb94b[CRI] explicitly disable CRI generation for non-JVM targets to avoid false-po...6c2c458Scripting: fix jvmTarget processing from script annotationsDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions