chore: bump net.bytebuddy:byte-buddy from 1.15.11 to 1.18.13 in /android

[dependabot]

Bumps net.bytebuddy:byte-buddy from 1.15.11 to 1.18.13.

Release notes

Sourced from net.bytebuddy:byte-buddy's releases.

Byte Buddy 1.18.13

• Actually include the SBOM within the published artifacts.
• Avoid propagation of path traversals that are contained in jar files which are copied without transformation.
• Avoid repeated traversal of previously visited type hierarchies to improve performance.
• Correct Kotlin support of the Gradle plugin to redirect the classes directory of a source set while retaining support for legacy Gradle versions.
• Create Gradle tasks using Gradle's task registration API if available.

Byte Buddy 1.18.12

• Automatically support Kotlin in Gradle plugin.
• Add support for native attach on Windows for ARM64.
• Correct JNA injector which accidentally created on based on Unsafe.

Byte Buddy 1.18.11

• Add SBOM to published artifacts.
• Check for traversable paths injected into class files as a rather hypothetical attack vector.

Byte Buddy 1.18.10

• Delay change of default for unsage use to Java 26 and improve error message.

Byte Buddy 1.18.9

• Disable use of Unsafe by default when Java 25or newer is discovered.
• Check for escape when creating folders in Plugin.Engine.
• Improve OpenJ9 attachment.
• Avoid null pointer on missing annotation types.
• Improve diagnostics for external agent attachment.
• Improve on Gradle context discovery.
• Support Android libraries on AGP9 or newer.
• Update ASM.

Byte Buddy 1.18.8

• Improve support for repeatable builds.
• Fix reordering of exception table in type initializers when instrumenting.

Byte Buddy 1.18.7

• Introduce new versioning concept with -jdk5 suffix for backwards-compatible jar and Java 8 baseline for regular jar.

Byte Buddy 1.18.5

• Eagerly resolve of canonical files during attach emulation to avoid failure when process ends before file can be deleted.
• Add super classes to hash code / equals computation in Advice that were missing.

Byte Buddy 1.18.4

• Add support for new build description in Android 9.

Byte Buddy 1.18.3

• Avoid using Class File API when Byte Buddy is loaded on the boot loader where multi-release jars are not available.
• Add additional safety when processing class files with illegally formed parameters.
• Update to latest ASM.

Byte Buddy 1.18.2

• Support modifiers for value classes in Valhalla builds.

... (truncated)

Changelog

Sourced from net.bytebuddy:byte-buddy's changelog.

2. September 2026: version 1.18.13

• Actually include the SBOM within the published artifacts.
• Avoid propagation of path traversals that are contained in jar files which are copied without transformation.
• Avoid repeated traversal of previously visited type hierarchies to improve performance.
• Correct Kotlin support of the Gradle plugin to redirect the classes directory of a source set while retaining support for legacy Gradle versions.
• Create Gradle tasks using Gradle's task registration API if available.

17. July 2026: version 1.18.12

• Automatically support Kotlin in Gradle plugin.
• Correct JNA injector which accidentally created on based on Unsafe.
• Support dynamic attach on Windows ARM64 by shipping a native attach_hotspot_windows library for win32-aarch64.

2. July 2026: version 1.18.11

• Add SBOM to published artifacts.
• Check for traversable paths injected into class files as a rather hypothetical attack vector.

3. June 2026: version 1.18.10

• Delay change of default for unsage use to Java 26 and improve error message.

1. June 2026: version 1.18.9

• Disable use of Unsafe by default when Java 25or newer is discovered.
• Check for escape when creating folders in Plugin.Engine.
• Improve OpenJ9 attachment.
• Avoid null pointer on missing annotation types.
• Improve diagnostics for external agent attachment.
• Improve on Gradle context discovery.
• Support Android libraries on AGP9 or newer.
• Update ASM.

1. April 2026: version 1.18.8

• Improve support for repeatable builds.
• Fix reordering of exception table in type initializers when instrumenting.

1. March 2026: version 1.18.7

• Introduce new versioning concept with -jdk5 suffix for backwards-compatible jar and Java 8 baseline for regular jar.

27. February 2026: version 1.18.6

Accidental release during rework of release pipeline. Functional, but with incorrect suffices.

15. February 2026: version 1.18.5

• Eagerly resolve of canonical files during attach emulation to avoid failure when process ends before file can be deleted.

... (truncated)

Commits

• d4da515 [publish] Releasing Byte Buddy 1.18.13
• bb914e3 [release] Release new version
• af2034b Create Gradle tasks via the task registration API if available to avoid the u...
• 30aca55 Shortcut traversal of previously visited type hierarchies and harden 1-1 tran...
• debd527 Bump actions/checkout from 6.0.2 to 7.0.1 (#1910)
• 8315af6 Bump step-security/harden-runner from 2.16.1 to 2.19.4 (#1909)
• e30e24f Bump actions/cache from 5.0.3 to 5.0.5 (#1914)
• 1885f2a Bump github/codeql-action from 3.27.6 to 4.36.2 (#1916)
• de4ed85 Correct Javadoc of Gradle plugin to avoid errors and warnings during generation.
• 5d3a312 Bump actions/setup-java from 5.2.0 to 5.4.0 (#1918)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[cursor]

PR Summary

Medium Risk
Changing the forced Byte Buddy version affects the Android test dependency graph and may reintroduce AGP Jetifier/class-file-version build issues that the previous 1.15.11 pin was meant to avoid.

Overview
Updates the Gradle resolutionStrategy in android/build.gradle to force net.bytebuddy:byte-buddy and net.bytebuddy:byte-buddy-agent from 1.15.11 to 1.18.13, overriding the Byte Buddy version pulled in transitively by Mockito (mockito-core / mockito-android 5.23.0) for Android unit tests.

The surrounding comment still describes pinning 1.15.x to avoid Jetifier failures on newer multi-release Byte Buddy artifacts; that text was not updated in this diff.

^{Reviewed by Cursor Bugbot for commit 8430da3. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 8430da3. Configure here.}

[cursor]

Byte Buddy bump rebreaks Jetifier

High Severity

The resolutionStrategy now forces byte-buddy and byte-buddy-agent to 1.18.13, which still ships the META-INF/versions/24 overlay that this AGP's Jetifier cannot parse. That pin existed to stay on 1.15.x so Android builds would not fail with unsupported class file major version 68.

 

^{Reviewed by Cursor Bugbot for commit 8430da3. Configure here.}

[nickolas-dimitrakas]

Closing — moot once #393 merges. #393 removes the byte-buddy force-pin entirely (it existed only to dodge a Jetifier bug; disabling Jetifier fixes that at the root), so there's no longer a pinned version for this PR to bump. Byte-buddy will resolve naturally to whatever mockito 5.23.0 declares (1.17.7, its own tested pairing) unless a real reason comes up to override that.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.