build: update Gradle and patch SDK dependency vulnerabilities

[dependabot]

Updates the Gradle wrapper to 9.7.0 and refreshes all dependency locks.

Also resolves every open GitHub code-scanning advisory in this SDK:

• Kotlin Gradle plugin to 2.4.20-RC (first published patched line)
• Apache HttpClient to 5.6.4
• Apache HttpCore and HttpCore H2 to 5.4.3
• Log4j to 2.26.1

Additional stable dependency updates include OkHttp 5.5.0, JUnit 6.1.3, JUnit Pioneer 2.3.0, and Mockito Kotlin 6.3.0.

The repair also records complete cold-cache verification metadata and excludes the shrinker fixture from aggregate coverage inputs under Gradle 9.7.

Validation:

• dependency licenses and OSV audit pass with no findings
• cold-cache dependency verification passes
• 1,418 tests across 329 suites pass
• aggregate coverage policy passes
• lint, build, ProGuard, and R8 pass
• 15 Maven artifacts are byte-identical across isolated builds

[kriptoburak]

I verified the update locally. The license and OSV audit is clean. All 1,418 tests, coverage, and 15 reproducible Maven artifacts pass. The dependency graph no longer contains the 5 versions reported by GitHub code scanning.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	org.jetbrains.kotlin/​kotlin-scripting-compiler-embeddable@​2.4.0 ⏵ 2.4.20-Beta2	-4
	org.apache.httpcomponents.client5/​httpclient5@​5.5.1 ⏵ 5.6.4		+2
	org.junit.jupiter/​junit-jupiter-engine@​5.14.3 ⏵ 6.1.3
	org.junit.platform/​junit-platform-launcher@​1.14.3 ⏵ 6.1.3
	org.junit-pioneer/​junit-pioneer@​1.9.1 ⏵ 2.3.0
	org.junit.jupiter/​junit-jupiter-params@​5.14.3 ⏵ 6.1.3
	org.mockito.kotlin/​mockito-kotlin@​4.1.0 ⏵ 6.3.0	-28
	org.jetbrains.kotlin/​kotlin-gradle-plugin@​2.4.0 ⏵ 2.4.20-Beta2	-31	+2	+11		-19
	org.junit/​junit-bom@​5.14.3 ⏵ 6.1.3					-30
	org.jetbrains.kotlin/​kotlin-reflect@​2.3.21 ⏵ 2.4.0	+64
	org.jetbrains.kotlin/​kotlin-sam-with-receiver-compiler-plugin-embeddable@​2.3.21 ⏵ 2.4.20-Beta2	-1
	org.jetbrains.kotlin/​kotlin-stdlib-common@​2.3.21 ⏵ 2.4.0
	com.squareup.okhttp3/​logging-interceptor@​5.4.0 ⏵ 5.5.0	-1
	org.apache.httpcomponents.core5/​httpcore5-h2@​5.3.6 ⏵ 5.4.3	-2	+16
	com.squareup.okhttp3/​okhttp@​5.4.0 ⏵ 5.5.0

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		License policy violation: maven org.apache.httpcomponents.client5:httpclient5 under MPL-2.0 License: MPL-2.0 - The applicable license policy does not permit this license (5) (org/publicsuffix/list/effective_tld_names.dat) From: x-twitter-scraper-java-client-okhttp/gradle.lockfile → maven/org.apache.httpcomponents.client5/httpclient5@5.6.4 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/org.apache.httpcomponents.client5/httpclient5@5.6.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: maven org.apache.httpcomponents.core5:httpcore5 is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: x-twitter-scraper-java-client-okhttp/gradle.lockfile → maven/org.apache.httpcomponents.core5/httpcore5-h2@5.4.3 → maven/org.apache.httpcomponents.core5/httpcore5@5.4.3 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/org.apache.httpcomponents.core5/httpcore5@5.4.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: maven org.jetbrains.kotlin:kotlin-gradle-plugin is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: buildSrc/gradle.lockfile → maven/org.jetbrains.kotlin/kotlin-gradle-plugin@2.4.20-Beta2 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/org.jetbrains.kotlin/kotlin-gradle-plugin@2.4.20-Beta2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: maven org.junit-pioneer:junit-pioneer under EPL-2.0 License: EPL-2.0 - The applicable license policy does not permit this license (5) (META-INF/LICENSE.md) From: x-twitter-scraper-java-core/gradle.lockfile → maven/org.junit-pioneer/junit-pioneer@2.3.0 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/org.junit-pioneer/junit-pioneer@2.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: maven org.junit.jupiter:junit-jupiter-api under EPL-2.0 License: EPL-2.0 - The applicable license policy does not permit this license (5) (Maven pom file) License: EPL-2.0 - The applicable license policy does not permit this license (5) (META-INF/LICENSE.md) From: x-twitter-scraper-java-core/gradle.lockfile → maven/org.junit.jupiter/junit-jupiter-engine@6.1.3 → maven/org.junit.jupiter/junit-jupiter-params@6.1.3 → maven/org.junit.jupiter/junit-jupiter-api@6.1.3 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/org.junit.jupiter/junit-jupiter-api@6.1.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: maven org.junit.jupiter:junit-jupiter-engine under EPL-2.0 License: EPL-2.0 - The applicable license policy does not permit this license (5) (Maven pom file) License: EPL-2.0 - The applicable license policy does not permit this license (5) (META-INF/LICENSE.md) From: x-twitter-scraper-java-core/gradle.lockfile → maven/org.junit.jupiter/junit-jupiter-engine@6.1.3 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/org.junit.jupiter/junit-jupiter-engine@6.1.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: maven org.junit.jupiter:junit-jupiter-params under EPL-2.0 License: EPL-2.0 - The applicable license policy does not permit this license (5) (Maven pom file) License: EPL-2.0 - The applicable license policy does not permit this license (5) (META-INF/LICENSE.md) From: x-twitter-scraper-java-core/gradle.lockfile → maven/org.junit.jupiter/junit-jupiter-params@6.1.3 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/org.junit.jupiter/junit-jupiter-params@6.1.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: maven org.junit.platform:junit-platform-commons under EPL-2.0 License: EPL-2.0 - The applicable license policy does not permit this license (5) (Maven pom file) License: EPL-2.0 - The applicable license policy does not permit this license (5) (META-INF/LICENSE.md) From: x-twitter-scraper-java-core/gradle.lockfile → maven/org.junit.jupiter/junit-jupiter-engine@6.1.3 → maven/org.junit.jupiter/junit-jupiter-params@6.1.3 → maven/org.junit.platform/junit-platform-launcher@6.1.3 → maven/org.junit.platform/junit-platform-commons@6.1.3 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/org.junit.platform/junit-platform-commons@6.1.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: maven org.junit.platform:junit-platform-engine under EPL-2.0 License: EPL-2.0 - The applicable license policy does not permit this license (5) (Maven pom file) License: EPL-2.0 - The applicable license policy does not permit this license (5) (META-INF/LICENSE.md) From: x-twitter-scraper-java-core/gradle.lockfile → maven/org.junit.jupiter/junit-jupiter-engine@6.1.3 → maven/org.junit.platform/junit-platform-launcher@6.1.3 → maven/org.junit.platform/junit-platform-engine@6.1.3 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/org.junit.platform/junit-platform-engine@6.1.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: maven org.junit.platform:junit-platform-launcher under EPL-2.0 License: EPL-2.0 - The applicable license policy does not permit this license (5) (Maven pom file) License: EPL-2.0 - The applicable license policy does not permit this license (5) (META-INF/LICENSE.md) From: x-twitter-scraper-java-core/gradle.lockfile → maven/org.junit.platform/junit-platform-launcher@6.1.3 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/org.junit.platform/junit-platform-launcher@6.1.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: maven org.junit:junit-bom under EPL-2.0 License: EPL-2.0 - The applicable license policy does not permit this license (5) (Maven pom file) From: x-twitter-scraper-java-core/gradle.lockfile → maven/org.junit/junit-bom@6.1.3 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/org.junit/junit-bom@6.1.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[kriptoburak]

I validated dependency verification, vulnerability remediation, coverage wiring, tests, artifacts, and the audit on the repaired head.