[dependabot]

Bumps net.bytebuddy:byte-buddy from 1.18.10 to 1.18.16.

Release notes

Sourced from net.bytebuddy:byte-buddy's releases.

Byte Buddy 1.18.16

• Correct detection of a dropped implicit this frame in constructors with long or double parameters when using Advice.
• Detect a dropped uninitialized this frame in constructors after full frames when using Advice with copied arguments.
• Update ASM to version 9.11.1 and the ASM to Class File API bridge to version 0.0.14.
• Use a valid tag for the Gradle plugin portal.

Byte Buddy 1.18.15

• Update ASM to version 9.11 and add support for Java 28.

Byte Buddy 1.18.14

• Avoid exposure of the agent argument on the command line of the process that is spawned for an external attachment.
• Avoid the resolution of symbolic links when the Gradle plugin deletes a folder recursively.
• Limit the nesting depth that is accepted when parsing a generic type signature to avoid an exhaustion of the stack for a malformed class file.
• Sign all deployed files using sigstore, in addition to the existing GPG signature.
• Validate entry names when the Android plugin retains a file to avoid the propagation of path traversals.

Byte Buddy 1.18.13

• Actually include the SBOM within the published artifacts.
• Avoid propagation of path traversals that are contained in jar files which are copied without transformation.
• Avoid repeated traversal of previously visited type hierarchies to improve performance.
• Correct Kotlin support of the Gradle plugin to redirect the classes directory of a source set while retaining support for legacy Gradle versions.
• Create Gradle tasks using Gradle's task registration API if available.

Byte Buddy 1.18.12

• Automatically support Kotlin in Gradle plugin.
• Add support for native attach on Windows for ARM64.
• Correct JNA injector which accidentally created on based on Unsafe.

Byte Buddy 1.18.11

• Add SBOM to published artifacts.
• Check for traversable paths injected into class files as a rather hypothetical attack vector.

Changelog

Sourced from net.bytebuddy:byte-buddy's changelog.

23. October 2026: version 1.18.16

• Correct detection of a dropped implicit this frame in constructors with long or double parameters when using Advice.
• Detect a dropped uninitialized this frame in constructors after full frames when using Advice with copied arguments.
• Update ASM to version 9.11.1 and the ASM to Class File API bridge to version 0.0.14.
• Use a valid tag for the Gradle plugin portal.

13. October 2026: version 1.18.15

• Update ASM to version 9.11 and add support for Java 28.

14. September 2026: version 1.18.14

• Avoid exposure of the agent argument on the command line of the process that is spawned for an external attachment.
• Avoid the resolution of symbolic links when the Gradle plugin deletes a folder recursively.
• Limit the nesting depth that is accepted when parsing a generic type signature to avoid an exhaustion of the stack for a malformed class file.
• Sign all deployed files using sigstore, in addition to the existing GPG signature.
• Validate entry names when the Android plugin retains a file to avoid the propagation of path traversals.

2. September 2026: version 1.18.13

• Actually include the SBOM within the published artifacts.
• Avoid propagation of path traversals that are contained in jar files which are copied without transformation.
• Avoid repeated traversal of previously visited type hierarchies to improve performance.
• Correct Kotlin support of the Gradle plugin to redirect the classes directory of a source set while retaining support for legacy Gradle versions.
• Create Gradle tasks using Gradle's task registration API if available.

17. July 2026: version 1.18.12

• Automatically support Kotlin in Gradle plugin.
• Correct JNA injector which accidentally created on based on Unsafe.
• Support dynamic attach on Windows ARM64 by shipping a native attach_hotspot_windows library for win32-aarch64.

2. July 2026: version 1.18.11

• Add SBOM to published artifacts.
• Check for traversable paths injected into class files as a rather hypothetical attack vector.

Commits

• 0229449 [publish] Releasing Byte Buddy 1.18.16
• 29c1a29 [release] Complete failed release from where it failed.
• 2f7c4ed Change tag which was rejected.
• 6ade578 [release] Release new version
• 7d6ad78 Update checksums
• d7bf69f Detect dropped uninitialized 'this' frame in constructors after full frames.
• 2901502 Compare constructor frame divergence in frame entries rather than slots.
• 8ade117 Update ASM and bridge.
• 4e25942 [publish] Start next development iteration 1.18.16-SNAPSHOT
• f2dffef [publish] Releasing Byte Buddy 1.18.15
• Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
net.bytebuddy:byte-buddy	[>= 1.14.19.a, < 1.14.20]

[satsukies]

@dependabot rebase