chore(deps): bump com.gradleup.shadow from 9.4.3 to 9.5.1

[dependabot]

Bumps com.gradleup.shadow from 9.4.3 to 9.5.1.

Release notes

Sourced from com.gradleup.shadow's releases.

9.5.1

Fixed

• Fix eager calls for toolchainSpec in Kotlin DSL. (#2087)

9.5.0

Added

• Check DuplicatesStrategy for merging transformers. (#2026)
  This will log warnings when an incompatible DuplicatesStrategy (e.g., EXCLUDE) is applied in Gradle configuration for built-in ResourceTransformers.
• Add KotlinModuleMetadataTransformer. (#2073)
• Add R8 as an opt-in minimize { r8 { ... } } tool for shrinking the final shadowed JAR. (#2077)

Changed

• Bump min Gradle requirement to 9.2.0. (#2057)
• Remove afterEvaluate when adding variants. (#2056)
• Deprecate enableKotlinModuleRemapping for ShadowJar. (#2073)
  Apply KotlinModuleMetadataTransformer explicitly to support relocating inside Kotlin module metadata files.
• Deprecate everything under ShadowCopyAction. (#2083)

Fixed

• Fix the conflicts when using afterEvaluate with other plugins. (#2055)

Commits

• c33612d Prepare version 9.5.1
• 485e412 Fix eager calls for toolchainSpec in Kotlin DSL (#2087)
• d062fa2 Fix DuplicatesStrategyCheckerTest resource loading on Windows (#2085)
• e71a2c1 Add description for shadow configuration (#2084)
• 7ba43b0 Prepare next development version
• 6e00cb7 Prepare version 9.5.0
• ca03909 Deprecate everything under ShadowCopyAction (#2083)
• 7d7da27 Revert "Mark CONSTANT_TIME_FOR_ZIP_ENTRIES as const (#2074)"
• da18cc0 Deprecate enableKotlinModuleRemapping for ShadowJar (#2073)
• ec6e55a Replace system properties with buildConfig consts (#2082)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

📦 Artifacts

Name	Size	Updated	Expiration
	2.97 MB	Jul 9, 26, 2:06:11 PM UTC	Jul 16, 26, 2:06:10 PM UTC

🛡 Trivy

Vulnerability in: Java

Vulnerability	Severity	Package	Installed Version	Fixed Version
CVE-2026-54512	HIGH	com.fasterxml.jackson.core:jackson-databind	2.21.1	2.18.8, 3.1.4, 2.21.4
CVE-2026-54512	HIGH	com.fasterxml.jackson.core:jackson-databind	2.21.1	2.18.8, 3.1.4, 2.21.4
CVE-2026-54512	HIGH	com.fasterxml.jackson.core:jackson-databind	2.21.1	2.18.8, 3.1.4, 2.21.4
CVE-2026-54513	HIGH	com.fasterxml.jackson.core:jackson-databind	2.21.1	2.18.8, 2.21.4, 3.1.4
CVE-2026-54513	HIGH	com.fasterxml.jackson.core:jackson-databind	2.21.1	2.18.8, 2.21.4, 3.1.4
CVE-2026-54513	HIGH	com.fasterxml.jackson.core:jackson-databind	2.21.1	2.18.8, 2.21.4, 3.1.4
CVE-2026-54514	MEDIUM	com.fasterxml.jackson.core:jackson-databind	2.21.1	2.18.8, 2.21.4, 3.1.4
CVE-2026-54514	MEDIUM	com.fasterxml.jackson.core:jackson-databind	2.21.1	2.18.8, 2.21.4, 3.1.4
CVE-2026-54514	MEDIUM	com.fasterxml.jackson.core:jackson-databind	2.21.1	2.18.8, 2.21.4, 3.1.4
CVE-2026-54515	MEDIUM	com.fasterxml.jackson.core:jackson-databind	2.21.1	3.1.4, 2.18.9, 2.21.5, 2.22.1
CVE-2026-54515	MEDIUM	com.fasterxml.jackson.core:jackson-databind	2.21.1	3.1.4, 2.18.9, 2.21.5, 2.22.1
CVE-2026-54515	MEDIUM	com.fasterxml.jackson.core:jackson-databind	2.21.1	3.1.4, 2.18.9, 2.21.5, 2.22.1
CVE-2026-54516	MEDIUM	com.fasterxml.jackson.core:jackson-databind	2.21.1	2.21.4, 3.1.4
CVE-2026-54516	MEDIUM	com.fasterxml.jackson.core:jackson-databind	2.21.1	2.21.4, 3.1.4
CVE-2026-54516	MEDIUM	com.fasterxml.jackson.core:jackson-databind	2.21.1	2.21.4, 3.1.4
CVE-2026-54517	MEDIUM	com.fasterxml.jackson.core:jackson-databind	2.21.1	2.21.4, 3.1.4
CVE-2026-54517	MEDIUM	com.fasterxml.jackson.core:jackson-databind	2.21.1	2.21.4, 3.1.4
CVE-2026-54517	MEDIUM	com.fasterxml.jackson.core:jackson-databind	2.21.1	2.21.4, 3.1.4
CVE-2026-54518	MEDIUM	com.fasterxml.jackson.core:jackson-databind	2.21.1	2.21.4
CVE-2026-54518	MEDIUM	com.fasterxml.jackson.core:jackson-databind	2.21.1	2.21.4
CVE-2026-54518	MEDIUM	com.fasterxml.jackson.core:jackson-databind	2.21.1	2.21.4

🧪 Java Unit Tests

	Tests	Passed ✅	Skipped ⚠️	Failed	Time ⏱
Java Tests Report	144 ran	143 ✅	1 ⚠️	0 ❌	52s 1ms

🔁 Unreleased Commits

✅ No unreleased commits found.

[github-actions]

Tests report quick summary:

success ✅ > tests: 144, success: 143, skipped: 1, failed: 0

unfold for details

Project	Status	Success	Skipped	Failed
plugin-transform-grok	success ✅	20	0	0
plugin-transform-json	success ✅	16	0	0
plugin-transform-records	success ✅	107	1	0