chore(deps): bump the other-dependencies group across 2 directories with 3 updates

[dependabot]

Bumps the other-dependencies group with 2 updates in the /samples/kotlin-mcp-client directory: gradle-wrapper and com.anthropic:anthropic-java.
Bumps the other-dependencies group with 2 updates in the /samples/kotlinlang-mcp-server directory: gradle-wrapper and ch.qos.logback:logback-classic.

Updates gradle-wrapper from 9.8.0 to 9.8.1

Release notes

Sourced from gradle-wrapper's releases.

9.8.1

This is a patch release for Gradle 9.8.0. We recommend using 9.8.1 instead of 9.8.0.

This release addresses three high rated vulnerabilities:

• Unauthenticated worker-to-daemon channel deserializes untrusted Java objects
• Deserialization of untrusted Java objects before authentication in the client - daemon communication
• Failure to disable repositories failing to establish an SSL connection can expose builds to malicious artifacts

The following issues were resolved:

• [Gradle 9.8.0 complains again about invalid Toolchains on Debian / Ubuntu packaged systems]- (gradle/gradle#39358)
• Gradle 9.8.0 removes root java.util.logging handlers installed by a custom LogManager (breaks Quarkus test log capture)
• Dependency resolution regression

Read the Release Notes

We would like to thank the following community members for their contributions to this release of Gradle: Aman Gautam, Björn Kautler, Eng Zer Jun, Hashim Khan, Julian Krannich, KBS, Labh R Jethe, Mark Dodgson, Maxim, monkey, nataphon-ktsystems, Paul King, Qiu Tian, rg_sandesh, Roberto Perez Alcolea, Sean, Zongle Wang.

Upgrade instructions

Switch your build to use Gradle 9.8.1 by updating your wrapper:

./gradlew :wrapper --gradle-version=9.8.1 && ./gradlew :wrapper

See the Gradle 9.x upgrade guide to learn about deprecations, breaking changes and other considerations when upgrading.

For Java, Groovy, Kotlin and Android compatibility, see the full compatibility notes.

Reporting problems

If you find a problem with this release, please file a bug on GitHub Issues adhering to our issue guidelines. If you're not sure you're encountering a bug, please use the forum.

... (truncated)

Commits

• 39daf39 Release notes for Gradle 9.8.1 (#39409)
• 4fc92e5 Release notes for Gradle 9.8.1
• bfbd14a Make repository disabling stricter (#39403)
• 95e0bf9 Check daemon & worker preamble earlier (#39402)
• 7aa9a5b Improve display for distribution url in wrapper (#39401)
• 74a7720 Wrap GCP & S3 resolution errors into HTTP to reuse repository disabling mecha...
• 651110a Check worker token before any serialization similarly to daemon
• 8a6b9d9 Harden repository disabling: disable them by default on failure unless there'...
• f28e514 Check the daemon token before any serialization
• 86ab273 Replace credentials for distribution url with *** and avoid showing the plain...
• Additional commits viewable in compare view

Updates com.anthropic:anthropic-java from 2.65.0 to 2.71.0

Release notes

Sourced from com.anthropic:anthropic-java's releases.

v2.71.0

Features

• api: add types for the Chat and Cowork unified analytics metrics
• api: add workflows, multiagent configuration and thread status filtering to Managed Agents
• client: accept nested union values in single-argument factories
• client: add options() to read a client's configured options

Chores

• internal: generate the combined javadoc alongside compilation
• internal: remove unused structured output test helpers

v2.70.0

Features

• client: add getters and builders to the structured output classes

Bug Fixes

• client: throw before sending a request with an empty path parameter

Chores

• ci: check that pull requests update the changelog
• docs: note that listing Claude Console spend limits is in early access
• tests: remove the structured output delegation mirror tests (#350)

v2.69.0

2.69.0 (2026-10-07)

Full Changelog: v2.68.0...v2.69.0

Features

• api: add claude-haiku-5-5 and typed computer and browser toolset tool calls (8c207f2)
• api: add disabled to thinking types in model capabilities (9de8343)
• api: add display_name to RBAC roles and deprecate name (20b61fc)
• api: add include_default parameter to list workspaces (c1450d5)
• api: add lifecycle stage fields and filter to /v1/models (476c9df)
• api: add line to model objects (df57dee)
• api: add url_sources to the Managed Agents web_fetch tool config (9de8343)
• api: add web search and code execution support to model capabilities (9de8343)

Bug Fixes

... (truncated)

Changelog

Sourced from com.anthropic:anthropic-java's changelog.

2.71.0 (2026-10-09)

Features

• api: add types for the Chat and Cowork unified analytics metrics
• api: add workflows, multiagent configuration and thread status filtering to Managed Agents
• client: accept nested union values in single-argument factories
• client: add options() to read a client's configured options

Chores

• internal: generate the combined javadoc alongside compilation
• internal: remove unused structured output test helpers

2.70.0 (2026-10-08)

Features

• client: add getters and builders to the structured output classes

Bug Fixes

• client: throw before sending a request with an empty path parameter

Chores

• ci: check that pull requests update the changelog
• docs: note that listing Claude Console spend limits is in early access
• tests: remove the structured output delegation mirror tests (#350)

2.69.0 (2026-10-07)

Full Changelog: v2.68.0...v2.69.0

Features

• api: add claude-haiku-5-5 and typed computer and browser toolset tool calls (8c207f2)
• api: add disabled to thinking types in model capabilities (9de8343)
• api: add display_name to RBAC roles and deprecate name (20b61fc)
• api: add include_default parameter to list workspaces (c1450d5)
• api: add lifecycle stage fields and filter to /v1/models (476c9df)
• api: add line to model objects (df57dee)
• api: add url_sources to the Managed Agents web_fetch tool config (9de8343)
• api: add web search and code execution support to model capabilities (9de8343)

Bug Fixes

... (truncated)

Commits

• 59079f0 release: 2.71.0
• d36653a Merge pull request #368 from anthropics/synced/published
• 3d732f6 chore(internal): remove unused structured output test helpers (#371)
• f96bb50 feat(api): add workflows, multiagent configuration and thread status filterin...
• 857cf41 codegen metadata
• b437458 codegen metadata
• 06157d8 feat(client): add options() to read a client's configured options
• 4000cea feat(client): accept nested union values in single-argument factories
• 20f557d codegen metadata
• eafe43b codegen metadata
• Additional commits viewable in compare view

Updates gradle-wrapper from 9.8.0 to 9.8.1

Release notes

Sourced from gradle-wrapper's releases.

9.8.1

This is a patch release for Gradle 9.8.0. We recommend using 9.8.1 instead of 9.8.0.

This release addresses three high rated vulnerabilities:

• Unauthenticated worker-to-daemon channel deserializes untrusted Java objects
• Deserialization of untrusted Java objects before authentication in the client - daemon communication
• Failure to disable repositories failing to establish an SSL connection can expose builds to malicious artifacts

The following issues were resolved:

• [Gradle 9.8.0 complains again about invalid Toolchains on Debian / Ubuntu packaged systems]- (gradle/gradle#39358)
• Gradle 9.8.0 removes root java.util.logging handlers installed by a custom LogManager (breaks Quarkus test log capture)
• Dependency resolution regression

Read the Release Notes

We would like to thank the following community members for their contributions to this release of Gradle: Aman Gautam, Björn Kautler, Eng Zer Jun, Hashim Khan, Julian Krannich, KBS, Labh R Jethe, Mark Dodgson, Maxim, monkey, nataphon-ktsystems, Paul King, Qiu Tian, rg_sandesh, Roberto Perez Alcolea, Sean, Zongle Wang.

Upgrade instructions

Switch your build to use Gradle 9.8.1 by updating your wrapper:

./gradlew :wrapper --gradle-version=9.8.1 && ./gradlew :wrapper

See the Gradle 9.x upgrade guide to learn about deprecations, breaking changes and other considerations when upgrading.

For Java, Groovy, Kotlin and Android compatibility, see the full compatibility notes.

Reporting problems

If you find a problem with this release, please file a bug on GitHub Issues adhering to our issue guidelines. If you're not sure you're encountering a bug, please use the forum.

... (truncated)

Commits

• 39daf39 Release notes for Gradle 9.8.1 (#39409)
• 4fc92e5 Release notes for Gradle 9.8.1
• bfbd14a Make repository disabling stricter (#39403)
• 95e0bf9 Check daemon & worker preamble earlier (#39402)
• 7aa9a5b Improve display for distribution url in wrapper (#39401)
• 74a7720 Wrap GCP & S3 resolution errors into HTTP to reuse repository disabling mecha...
• 651110a Check worker token before any serialization similarly to daemon
• 8a6b9d9 Harden repository disabling: disable them by default on failure unless there'...
• f28e514 Check the daemon token before any serialization
• 86ab273 Replace credentials for distribution url with *** and avoid showing the plain...
• Additional commits viewable in compare view

Updates gradle-wrapper from 9.8.0 to 9.8.1

Release notes

Sourced from gradle-wrapper's releases.

9.8.1

This is a patch release for Gradle 9.8.0. We recommend using 9.8.1 instead of 9.8.0.

This release addresses three high rated vulnerabilities:

• Unauthenticated worker-to-daemon channel deserializes untrusted Java objects
• Deserialization of untrusted Java objects before authentication in the client - daemon communication
• Failure to disable repositories failing to establish an SSL connection can expose builds to malicious artifacts

The following issues were resolved:

• [Gradle 9.8.0 complains again about invalid Toolchains on Debian / Ubuntu packaged systems]- (gradle/gradle#39358)
• Gradle 9.8.0 removes root java.util.logging handlers installed by a custom LogManager (breaks Quarkus test log capture)
• Dependency resolution regression

Read the Release Notes

We would like to thank the following community members for their contributions to this release of Gradle: Aman Gautam, Björn Kautler, Eng Zer Jun, Hashim Khan, Julian Krannich, KBS, Labh R Jethe, Mark Dodgson, Maxim, monkey, nataphon-ktsystems, Paul King, Qiu Tian, rg_sandesh, Roberto Perez Alcolea, Sean, Zongle Wang.

Upgrade instructions

Switch your build to use Gradle 9.8.1 by updating your wrapper:

./gradlew :wrapper --gradle-version=9.8.1 && ./gradlew :wrapper

See the Gradle 9.x upgrade guide to learn about deprecations, breaking changes and other considerations when upgrading.

For Java, Groovy, Kotlin and Android compatibility, see the full compatibility notes.

Reporting problems

If you find a problem with this release, please file a bug on GitHub Issues adhering to our issue guidelines. If you're not sure you're encountering a bug, please use the forum.

... (truncated)

Commits

• 39daf39 Release notes for Gradle 9.8.1 (#39409)
• 4fc92e5 Release notes for Gradle 9.8.1
• bfbd14a Make repository disabling stricter (#39403)
• 95e0bf9 Check daemon & worker preamble earlier (#39402)
• 7aa9a5b Improve display for distribution url in wrapper (#39401)
• 74a7720 Wrap GCP & S3 resolution errors into HTTP to reuse repository disabling mecha...
• 651110a Check worker token before any serialization similarly to daemon
• 8a6b9d9 Harden repository disabling: disable them by default on failure unless there'...
• f28e514 Check the daemon token before any serialization
• 86ab273 Replace credentials for distribution url with *** and avoid showing the plain...
• Additional commits viewable in compare view

Updates gradle-wrapper from 9.8.0 to 9.8.1

Release notes

Sourced from gradle-wrapper's releases.

9.8.1

This is a patch release for Gradle 9.8.0. We recommend using 9.8.1 instead of 9.8.0.

This release addresses three high rated vulnerabilities:

• Unauthenticated worker-to-daemon channel deserializes untrusted Java objects
• Deserialization of untrusted Java objects before authentication in the client - daemon communication
• Failure to disable repositories failing to establish an SSL connection can expose builds to malicious artifacts

The following issues were resolved:

• [Gradle 9.8.0 complains again about invalid Toolchains on Debian / Ubuntu packaged systems]- (gradle/gradle#39358)
• Gradle 9.8.0 removes root java.util.logging handlers installed by a custom LogManager (breaks Quarkus test log capture)
• Dependency resolution regression

Read the Release Notes

We would like to thank the following community members for their contributions to this release of Gradle: Aman Gautam, Björn Kautler, Eng Zer Jun, Hashim Khan, Julian Krannich, KBS, Labh R Jethe, Mark Dodgson, Maxim, monkey, nataphon-ktsystems, Paul King, Qiu Tian, rg_sandesh, Roberto Perez Alcolea, Sean, Zongle Wang.

Upgrade instructions

Switch your build to use Gradle 9.8.1 by updating your wrapper:

./gradlew :wrapper --gradle-version=9.8.1 && ./gradlew :wrapper

See the Gradle 9.x upgrade guide to learn about deprecations, breaking changes and other considerations when upgrading.

For Java, Groovy, Kotlin and Android compatibility, see the full compatibility notes.

Reporting problems

If you find a problem with this release, please file a bug on GitHub Issues adhering to our issue guidelines. If you're not sure you're encountering a bug, please use the forum.

... (truncated)

Commits

• 39daf39 Release notes for Gradle 9.8.1 (#39409)
• 4fc92e5 Release notes for Gradle 9.8.1
• bfbd14a Make repository disabling stricter (#39403)
• 95e0bf9 Check daemon & worker preamble earlier (#39402)
• 7aa9a5b Improve display for distribution url in wrapper (#39401)
• 74a7720 Wrap GCP & S3 resolution errors into HTTP to reuse repository disabling mecha...
• 651110a Check worker token before any serialization similarly to daemon
• 8a6b9d9 Harden repository disabling: disable them by default on failure unless there'...
• f28e514 Check the daemon token before any serialization
• 86ab273 Replace credentials for distribution url with *** and avoid showing the plain...
• Additional commits viewable in compare view

Updates ch.qos.logback:logback-classic from 1.6.4 to 1.6.5

Release notes

Sourced from ch.qos.logback:logback-classic's releases.

Logback 1.6.5

2026-09-30 Release of logback version 1.6.5

• Fixed a vulnerability CVE-2026-104721 closely related to CVE-2026-19880. The fix in version 1.6.3, which strips forward and backward slashes from MDC values, was insufficient. An MDC value could still contain relative path components such as .., variable references such as /, or characters that are special in file name patterns and email addresses. This latest vulnerability was found and reported by François Martin (GitHub: @​martinfrancois, https://github.com/martinfrancois).

MDCBasedDiscriminator, used by SiftingAppender, now rejects MDC values instead of stripping characters from them. An MDC value is rejected if it is empty, if it is longer than 64 characters, if it contains the sequence .., or if it contains any of the following characters: / \ $ { } [ ] ( ) | ? * + % , @. When an MDC value is rejected, the discriminator returns the value of its DefaultValue property. A warning is emitted for each rejected value. These warnings are rate-limited.

• When compression is enabled, TimeBasedRollingPolicy and SizeAndTimeBasedRollingPolicy now also remove old log files that were never compressed, for example because the application was not running at rollover time. Previously, such files were ignored by maxHistory and accumulated indefinitely. This issue was discussed in discussions/1032. See TimeBasedRollingPolicy.

• SimpleInvocationGate, deprecated in version 1.6.3, is now marked for removal. Use FixedIntervalInvocationGate instead.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit d1b829dcdb9fd98511c64401beb1419a9c9384aa associated with the tag v_1.6.5. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Commits

• d1b829d prepare release 1.6.5
• 065b9b2 enhance protectin against mischievious MDC values in MDCBasedDiscriminator
• b69beab complete commit in relation to discussion_1032
• 7266c0b fix intermittently failing SocketAppenderMessageLossTest rest condition
• a633bb0 fix intermittently failing SocketAppenderMessageLossTest rest condition
• 2bc5bcc renamed tbrp and eclosingTBRP, other minor changes
• 2cd8762 fix typo in AGENTS.md
• 647846c fix errors when running tests under intellij IDEA
• 1048917 removed ConsoleCharsetPropertyDefiner.java
• 39b5002 added 'since' and 'forRemoval' attributes to SimpleInvocationGate @​Deprecatio...
• See full diff in compare view

[jetbrains-air]

Nice one — the Gradle security patch and both library bumps check out, so this is good to merge.

_{Produced by Air Automations. Name: Code review / Run: https://air.jetbrains.cloud/org/05cf1a7f-6ab5-713b-abd3-29d0c8a05e2d/automations/409567ec-d3a7-40ac-ba95-8518ec577ac2?run=297df783-ac2a-44c3-9975-33a3a813a4f1}

[jetbrains-air]

Problem: this PR moves only 2 of the 6 Gradle wrapper copies in the repo to 9.8.1. gradle/wrapper/gradle-wrapper.properties (root) and samples/{kotlin-mcp-server,simple-streamable-server,weather-stdio-server} stay on 9.8.0, and the four stale gradle-wrapper.jar files are still byte-identical to the old 9.8.0 jar (238e777f…) while the two updated ones are 3b8a2577…. Dependabot has historically bumped the root wrapper in its own PR (#1023, #969, #949 …), but no such PR exists for 9.8.1 — it appears to have been folded into this group PR for the samples directories only, so the root copy will not self-heal.

Failure scenario: 9.8.0 is the release Gradle flagged for three high-rated advisories, including GHSA-j5m7-59rp-24f5 (a repository that fails to establish an SSL connection is not disabled, so a build can be served malicious artifacts). After this merges, build.yml, conformance.yml and — most importantly — gradle-publish.yml, which runs ./gradlew publishToMavenCentral for the released SDK, all still execute Gradle 9.8.0. The PR title reads as a repo-wide wrapper bump, so the gap is easy to miss.

Suggested fix: in the repository root and in each of the three remaining sample directories, run ./gradlew wrapper --gradle-version=9.8.1 twice (Gradle needs the second invocation to rewrite the wrapper jar), and include those four gradle-wrapper.properties + gradle-wrapper.jar pairs here or in an immediate follow-up PR.

[jetbrains-air]

Problem: kotlinlang-mcp-server is not in the samples.yml build matrix (it lists only kotlin-mcp-client, kotlin-mcp-server, simple-streamable-server, weather-stdio-server) and no other workflow references it, so this logback bump — and the wrapper bump alongside it — is never compiled before merge. Half of this PR ships on review alone.

Failure scenario: a dependency bump to this sample that does break compilation merges green and lands on main undetected; the only consumers who find out are users who clone the sample or build its Dockerfile. (For this particular bump the risk is nil: 1.6.5's behaviour change is confined to MDCBasedDiscriminator/SiftingAppender, and src/main/resources/logback.xml uses only a ConsoleAppender — but that was verified by hand, not by CI.)

Suggested fix: add - kotlinlang-mcp-server to the strategy.matrix.sample list in .github/workflows/samples.yml so the directory is covered by ./gradlew build like the other four samples.

[devcrocod]

@dependabot rebase