Upgrade Gradle, sccache, clang-format, GoogleTest, and other dependencies

.github/android-consumer-test/settings.gradle.kts

@@ -14,13 +14,13 @@ pluginManagement {
         gradlePluginPortal()
     }
     plugins {
-        // AGP 9.3.x requires Gradle >= 9.5.0 — see the gradle-version pins on the CI jobs
+        // AGP 9.4.x requires Gradle >= 9.6.0 — see the gradle-version pins on the CI jobs
         // that build this fixture in publish.yml (package-android-aar, test-android-emulator).
         // Stay at >= 9.2.1: 9.2.1 (not 9.2.0) first fixed a real R8 regression
         // (java.lang.ClassNotFoundException on com.android.tools.r8.RecordTag after
         // upgrading Gradle to 9.x with AGP 9.2.0) that hits this fixture directly since
-        // buildTypes.release sets isMinifyEnabled = true; 9.3.0 carries that fix forward.
-        id("com.android.application") version "9.3.0"
+        // buildTypes.release sets isMinifyEnabled = true; 9.4.0 carries that fix forward.
+        id("com.android.application") version "9.4.0"
     }
 }
 

.github/build.sh

@@ -33,9 +33,9 @@ fi
 #
 # SCCACHE_DL_VERSION is overridable per-job, so a container that crashes one sccache build can
 # try another without editing this script (the in-container panic that stalled phase 2 was on
-# v0.8.2; v0.16.0 is the latest release and the default). A wrong/unavailable version just fails
+# v0.8.2; v0.18.0 is the latest release and the default). A wrong/unavailable version just fails
 # the `curl -f` and falls back to an uncached build, so bumping it can never red a build.
-SCCACHE_DL_VERSION="${SCCACHE_DL_VERSION:-0.16.0}"
+SCCACHE_DL_VERSION="${SCCACHE_DL_VERSION:-0.18.0}"
 case "$(uname -m)" in
   x86_64)        SCCACHE_DL_ARCH="x86_64" ;;
   aarch64|arm64) SCCACHE_DL_ARCH="aarch64" ;;

.github/workflows/clang-format.yml

@@ -12,7 +12,7 @@ on:
 # reproducible between contributors and CI. Bump CLANG_FORMAT_VERSION here and in
 # CLAUDE.md (Code Formatting) together, then reformat the tree with the same version.
 env:
-  CLANG_FORMAT_VERSION: "22.1.8"
+  CLANG_FORMAT_VERSION: "23.1.1"
 
 jobs:
   clang-format:

.github/workflows/osv-scanner.yml

@@ -19,15 +19,15 @@ permissions:
 jobs:
   scan-scheduled:
     if: ${{ github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
-    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.5.1"
+    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.6.0"
     permissions:
       actions: read
       contents: read
       security-events: write
 
   scan-pr:
     if: ${{ github.event_name == 'pull_request' }}
-    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@v2.5.1"
+    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@v2.6.0"
     permissions:
       actions: read
       contents: read

.github/workflows/publish.yml

@@ -245,7 +245,7 @@ jobs:
           distribution: temurin
       - uses: gradle/actions/setup-gradle@v6
         with:
-          gradle-version: "9.6.1"
+          gradle-version: "9.7.1"
       - name: Sign a throwaway artifact via useInMemoryPgpKeys (BouncyCastle)
         shell: bash
         env:
@@ -1034,7 +1034,7 @@ jobs:
       - uses: gradle/actions/setup-gradle@v6
         with:
           # AGP 9.3.0 (the .github/android-consumer-test fixture) requires Gradle >= 9.5.0.
-          gradle-version: "9.6.1"
+          gradle-version: "9.7.1"
       - name: Build core jar (byte-identical classes payload for the AAR)
         run: >
           mvn -B --no-transfer-progress -pl llama -am -DskipTests -Denforcer.skip=true
@@ -1165,7 +1165,7 @@ jobs:
       - uses: gradle/actions/setup-gradle@v6
         with:
           # AGP 9.3.0 (the .github/android-consumer-test fixture) requires Gradle >= 9.5.0.
-          gradle-version: "9.6.1"
+          gradle-version: "9.7.1"
       - name: Enable KVM group permissions (GitHub-hosted runner)
         run: |
           echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
@@ -1261,7 +1261,7 @@ jobs:
           # AGP 9.3.0 (android-llmservice) requires Gradle >= 9.5.0; also satisfies Kotlin
           # 2.4's Gradle-plugin floor. The AAR/lib-only jobs stay on an older Gradle since
           # they build no AGP project.
-          gradle-version: "9.6.1"
+          gradle-version: "9.7.1"
       - name: Build core jar + install llama-kotlin facade to mavenLocal
         # install (not package) so the app's Gradle build resolves llama-kotlin +
         # the core POM from mavenLocal. llama-kotlin's core dep is provided-scope, so the
@@ -1345,7 +1345,7 @@ jobs:
       - uses: gradle/actions/setup-gradle@v6
         with:
           # AGP 9.3.0 (android-llmservice) requires Gradle >= 9.5.0.
-          gradle-version: "9.6.1"
+          gradle-version: "9.7.1"
       - name: Enable KVM group permissions (GitHub-hosted runner)
         run: |
           echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
@@ -1607,7 +1607,7 @@ jobs:
         continue-on-error: true
         shell: pwsh
         run: |
-          $ver = "0.16.0"
+          $ver = "0.18.0"
           $rel = "sccache-v$ver-x86_64-pc-windows-msvc"
           $url = "https://github.com/mozilla/sccache/releases/download/v$ver/$rel.zip"
           Write-Host "Downloading $url"
@@ -1661,7 +1661,7 @@ jobs:
         continue-on-error: true
         shell: pwsh
         run: |
-          $ver = "0.16.0"
+          $ver = "0.18.0"
           $rel = "sccache-v$ver-x86_64-pc-windows-msvc"
           $url = "https://github.com/mozilla/sccache/releases/download/v$ver/$rel.zip"
           Write-Host "Downloading $url"
@@ -1790,7 +1790,7 @@ jobs:
         continue-on-error: true
         shell: pwsh
         run: |
-          $ver = "0.16.0"
+          $ver = "0.18.0"
           $rel = "sccache-v$ver-x86_64-pc-windows-msvc"
           $url = "https://github.com/mozilla/sccache/releases/download/v$ver/$rel.zip"
           Write-Host "Downloading $url"
@@ -1841,7 +1841,7 @@ jobs:
         continue-on-error: true
         shell: pwsh
         run: |
-          $ver = "0.16.0"
+          $ver = "0.18.0"
           $rel = "sccache-v$ver-x86_64-pc-windows-msvc"
           $url = "https://github.com/mozilla/sccache/releases/download/v$ver/$rel.zip"
           Write-Host "Downloading $url"
@@ -1885,7 +1885,7 @@ jobs:
         continue-on-error: true
         shell: pwsh
         run: |
-          $ver = "0.16.0"
+          $ver = "0.18.0"
           $rel = "sccache-v$ver-x86_64-pc-windows-msvc"
           $url = "https://github.com/mozilla/sccache/releases/download/v$ver/$rel.zip"
           Write-Host "Downloading $url"
@@ -3728,7 +3728,7 @@ jobs:
       # downloads above; the core jar was just built by the reactor deploy.
       - uses: gradle/actions/setup-gradle@v6
         with:
-          gradle-version: "9.6.1"
+          gradle-version: "9.7.1"
       - name: Publish Android AAR snapshots (llama-android + llama-android-opencl)
         run: |
           mkdir -p llama-android/natives/cpu/arm64-v8a llama-android/natives/cpu/x86_64 llama-android/natives/opencl/arm64-v8a
@@ -3986,7 +3986,7 @@ jobs:
       # built by the reactor deploy.
       - uses: gradle/actions/setup-gradle@v6
         with:
-          gradle-version: "9.6.1"
+          gradle-version: "9.7.1"
       - name: Publish Android AAR release bundle to Central Portal
         shell: bash
         run: |

CLAUDE.md

@@ -213,7 +213,7 @@ Wiring (mirrors the CUDA-Linux / OpenCL-Android classifier pattern):
    (`OpenCL.lib`), then delegates to `build.bat` with `-DOpenCL_INCLUDE_DIR`/`-DOpenCL_LIBRARY`
    (the Windows analogue of `build_opencl_android.sh`).
 4. **`.github/workflows/publish.yml`** — build jobs (all `windows-2025-vs2026`, `ilammy/msvc-dev-cmd@v1`,
-   sccache v0.16.0 zip + Depot WebDAV):
+   sccache v0.18.0 zip + Depot WebDAV):
    - `build-windows-x86_64` / `build-windows-x86` — **Ninja CPU**, artifacts `Windows-{arch}-libraries`
      → picked up by the `package` job's `pattern: "*-libraries"` into the **default** tree.
    - `build-windows-x86_64-msvc` / `build-windows-x86-msvc` — **MSVC CPU**, artifacts `Windows-{arch}-msvc`.
@@ -638,7 +638,7 @@ v0.16.0 + the probe this is no longer a risk.) Job-by-job status:
 Per-job recipe: add `env:` { `USE_CACHE`, `SCCACHE_WEBDAV_ENDPOINT`, `SCCACHE_WEBDAV_TOKEN` } and
 `DOCKCROSS_ARGS: "-e SCCACHE_WEBDAV_ENDPOINT -e SCCACHE_WEBDAV_TOKEN -e USE_CACHE"` — the
 dockcross wrapper only forwards host env it is explicitly told to via `-e`. The fetched sccache
-version is the `SCCACHE_DL_VERSION` knob in `build.sh` (default **0.16.0**; overridable per-job
+version is the `SCCACHE_DL_VERSION` knob in `build.sh` (default **0.18.0**; overridable per-job
 to try a different build against a container that crashed another). **Windows** is handled
 separately (the Visual Studio generator ignores `CMAKE_*_COMPILER_LAUNCHER`): see
 "Windows native classifiers" below — the **default** Windows CPU JAR now uses the **Ninja
@@ -1187,12 +1187,12 @@ not track the loader's own Java package). This is the same
 ### Code Formatting
 
 C++ formatting is **enforced in CI** (`.github/workflows/clang-format.yml`) with a **pinned**
-clang-format — currently **22.1.8**, installed via `pip install clang-format==22.1.8`. Format with
+clang-format — currently **23.1.1**, installed via `pip install clang-format==23.1.1`. Format with
 that exact version before committing; a different clang-format version reflows code differently and
 will fail the check.
 
 ```bash
-pip install "clang-format==22.1.8"
+pip install "clang-format==23.1.1"
 clang-format -i src/main/cpp/*.cpp src/main/cpp/*.hpp src/test/cpp/*.cpp   # Format C++ code
 ```
 
@@ -1604,7 +1604,7 @@ ctest --test-dir build --output-on-failure -R "ResultsToJson"
 
 llama.cpp is fetched via CMake FetchContent, pinned to `GIT_TAG b11062`.
 
-**GoogleTest** is a separate `BUILD_TESTING`-only FetchContent (`GIT_TAG v1.17.0`), used solely
+**GoogleTest** is a separate `BUILD_TESTING`-only FetchContent (`GIT_TAG v1.18.0`), used solely
 by the `jllama_test` C++ unit-test binary — not by the shipped library, and not coupled to the
 llama.cpp pin or the bundled nlohmann/json. There is **no constraint behind the exact tag**; it
 is just the latest stable at the time it was last touched. Bump it from time to time (nothing
@@ -2128,16 +2128,16 @@ compiles/loads the API); this one has a UI and is driven end-to-end. The name is
 domain is the only string that must be globally unique.
 
 Structure (mirrors the consumer-test's plumbing):
-- **`settings.gradle.kts`** — `rootProject.name = "android-llmservice"`; pins AGP `9.3.0` + the
+- **`settings.gradle.kts`** — `rootProject.name = "android-llmservice"`; pins AGP `9.4.0` + the
   Compose compiler plugin (`2.4.10`); `mavenLocal()` first so the freshly-built AAR + façade
   resolve there in CI (Maven Central for real users). Stay at `>= 9.2.1`: `9.2.1` (not `9.2.0`)
   first fixed a real R8 regression (`ClassNotFoundException` on `com.android.tools.r8.RecordTag`
   after upgrading Gradle to 9.x with AGP 9.2.0) that hits this project directly since
-  `buildTypes.release` sets `isMinifyEnabled = true`; `9.3.0` carries that fix forward and the
-  `.github/android-consumer-test` fixture is pinned the same way. AGP 9.3.x requires Gradle >= 9.5.0
+  `buildTypes.release` sets `isMinifyEnabled = true`; `9.4.0` carries that fix forward and the
+  `.github/android-consumer-test` fixture is pinned the same way. AGP 9.4.x requires Gradle >= 9.6.0
   and JDK 17+; CI already runs JDK 21 everywhere (`env.JAVA_VERSION`), so only the `gradle-version`
   pin on the jobs that build this project (and the `.github/android-consumer-test` fixture)
-  needed bumping (9.4.1 → 9.5.0). AGP 9.0+ has **built-in Kotlin support** (a runtime dependency on
+  needed bumping (currently `9.7.1`). AGP 9.0+ has **built-in Kotlin support** (a runtime dependency on
   Kotlin Gradle plugin 2.2.10+), so the standalone `org.jetbrains.kotlin.android` plugin is no longer
   applied — applying it now fails the build with "no longer required for Kotlin support since
   AGP 9.0" (`app/build.gradle.kts` line 7). The Compose compiler plugin still applies

android-llmservice/README.md

@@ -199,7 +199,7 @@ gradle -p android-llmservice connectedDebugAndroidTest -PjllamaVersion="$VERSION
 
 ```
 android-llmservice/
-├── settings.gradle.kts          # AGP 9.3.0 (built-in Kotlin) + Compose plugin 2.4.10, mavenLocal first
+├── settings.gradle.kts          # AGP 9.4.0 (built-in Kotlin) + Compose plugin 2.4.10, mavenLocal first
 ├── gradle.properties
 ├── requirements.md              # spec of record: every feature the app implements today (no unit tests)
 ├── TODO.md                      # roadmap: not-yet-built features

android-llmservice/settings.gradle.kts

@@ -14,19 +14,19 @@ pluginManagement {
         gradlePluginPortal()
     }
     // Versions pinned here (KISS: no version catalog). AGP matches the consumer-test
-    // fixture. AGP 9.3.x requires Gradle >= 9.5.0 — see the gradle-version pins on the CI
+    // fixture. AGP 9.4.x requires Gradle >= 9.6.0 — see the gradle-version pins on the CI
     // jobs that build this project in publish.yml. Stay at >= 9.2.1: 9.2.1 (not 9.2.0)
     // first fixed a real R8 regression (java.lang.ClassNotFoundException on
     // com.android.tools.r8.RecordTag after upgrading Gradle to 9.x with AGP 9.2.0) that
     // hits this project directly since buildTypes.release sets isMinifyEnabled = true;
-    // 9.3.0 carries that fix forward.
+    // 9.4.0 carries that fix forward.
     // AGP 9.0+ has built-in Kotlin support (runtime dependency on Kotlin Gradle plugin
     // 2.2.10+), so the standalone org.jetbrains.kotlin.android plugin is no longer
     // applied/needed — see https://developer.android.com/build/migrate-to-built-in-kotlin.
     // The Compose compiler plugin (2.4.10) still applies separately and exceeds AGP's
     // 2.2.10 floor.
     plugins {
-        id("com.android.application") version "9.3.0"
+        id("com.android.application") version "9.4.0"
         id("org.jetbrains.kotlin.plugin.compose") version "2.4.10"
     }
 }

llama/CMakeLists.txt

@@ -550,7 +550,7 @@ if(BUILD_TESTING)
         # No constraint behind this exact tag — GoogleTest is only used by this repo's own
         # C++ unit tests (jllama_test), not by the shipped library and not tied to llama.cpp.
         # It is just "latest stable at the time"; bump it from time to time (see CLAUDE.md).
-        GIT_TAG        v1.17.0
+        GIT_TAG        v1.18.0
     )
     # Keep GTest on the same CRT as the rest of the project.
     # OFF means GTest respects CMAKE_MSVC_RUNTIME_LIBRARY (static /MT here).

llama/pom.xml

@@ -67,7 +67,7 @@ SPDX-License-Identifier: MIT
 		<reactor.version>3.8.7</reactor.version>
 		<slf4j.version>2.0.19</slf4j.version>
 		<logback.version>1.6.3</logback.version>
-		<animal-sniffer.version>1.27</animal-sniffer.version>
+		<animal-sniffer.version>1.28</animal-sniffer.version>
 		<junit.version>6.1.3</junit.version>
 		<hamcrest.version>3.0</hamcrest.version>
 		<jmh.version>1.37</jmh.version>
@@ -101,7 +101,7 @@ SPDX-License-Identifier: MIT
 		<fb-contrib.version>7.7.4</fb-contrib.version>
 		<findsecbugs.version>1.14.0</findsecbugs.version>
 		<spotless.version>3.10.2</spotless.version>
-		<palantir-java-format.version>2.97.0</palantir-java-format.version>
+		<palantir-java-format.version>2.98.0</palantir-java-format.version>
 		<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 		<project.build.outputTimestamp>2026-09-01T07:57:45Z</project.build.outputTimestamp>
 	</properties>
@@ -420,7 +420,7 @@ SPDX-License-Identifier: MIT
 				<plugin>
 					<groupId>org.codehaus.mojo</groupId>
 					<artifactId>exec-maven-plugin</artifactId>
-					<version>3.6.3</version>
+					<version>3.6.4</version>
 				</plugin>
 				<plugin>
 					<groupId>org.jacoco</groupId>