[dependabot]

Bumps org.graalvm.buildtools.native from 1.1.11 to 1.1.12.

Release notes

Sourced from org.graalvm.buildtools.native's releases.

1.1.12

What's Changed

• Release 1.1.11 by @​graalvmbot in graalvm/native-build-tools#1037
• Improve native-image executable discovery with explicit/convention launcher distinction by @​vpelikh in graalvm/native-build-tools#845
• Bump version to 1.1.12-SNAPSHOT by @​graalvmbot in graalvm/native-build-tools#1040
• Update reachability metadata to 1.0.13 by @​graalvmbot in graalvm/native-build-tools#1041

Full Changelog: graalvm/native-build-tools@1.1.11...1.1.12

Commits

• b043a90 Release 1.1.12
• aeed1ab Merge pull request #1041 from graalvm/update-metadata-to-1.0.13
• 4d9fbd2 Update reachability metadata to 1.0.13
• 976c054 Merge pull request #1040 from graalvm/bump-version-to-1.1.12-SNAPSHOT
• 5025505 Bump version to 1.1.12-SNAPSHOT
• a3f832d Improve native-image executable discovery with explicit/convention launcher d...
• 510dbf4 Merge pull request #1037 from graalvm/release/1.1.11
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[kshivang]

@claude Please review this dependency update against current dev for substantive compatibility, security and regression issues. Check version constraints, Kotlin/Compose alignment, native classifiers where applicable, and CI coverage.

[claude]

Claude finished @kshivang's task in 2m 38s —— View job

---

Review: org.graalvm.buildtools.native 1.1.11 → 1.1.12

• Read the diff against origin/dev
• Check version constraints / catalog consistency
• Check consumers of the graalvmNative plugin alias
• Assess upstream changes for regression risk (launcher discovery, metadata 1.0.13)
• Kotlin/Compose alignment and native classifiers
• CI coverage for the affected path
• Post review

Verdict: safe to merge. No substantive compatibility, security or regression issue found. The one thing worth saying out loud is that CI gives this bump almost no signal, for reasons below.

---

The change

One line, gradle/libs.versions.toml:65, graalvm-native-plugin = "1.1.11" → "1.1.12". The version ref is consumed in exactly one place, gradle/libs.versions.toml:253 (graalvmNative = { id = "org.graalvm.buildtools.native", version.ref = ... }), and there is no second GraalVM coordinate in the catalog (no junit-platform-native, no graalvm-sdk, no native-maven-plugin) that would have to move in lockstep. So there is no catalog drift surface here.

Blast radius

Nine modules apply the alias, all microkernel modules under modules/: boss-app-browser, boss-app-editor, boss-app-terminal, boss-orchestrator, boss-mastery-orchestrator, boss-service-auth, boss-service-filesystem, boss-service-settings, boss-service-workspace. Each has the same shape - a main binary with --no-fallback, -H:+ReportExceptionStackTraces, --initialize-at-build-time=kotlin, and metadataRepository { enabled.set(true) }. None pins a metadata-repository version explicitly, so all nine take whatever the plugin bundles - 1.0.13 as of this release.

All nine are excluded from the build on Windows-ARM64 by settings.gradle.kts (the protoc classifier exclusion), so that platform is unaffected either way.

CI coverage - this is the real finding

grep across .github/workflows finds no nativeCompile, no nativeRun, no metadataCopy, no setup-graalvm, and no native-image anywhere. build.yml runs ./gradlew test --continue (:223) and ./gradlew build -PskipLint (:242) on Temurin 17, and build has no dependency on nativeCompile.

Both substantive upstream commits in 1.1.12 - the native-image launcher discovery rework (#845) and the reachability-metadata bump to 1.0.13 - only take effect when a native-image task actually executes. So a green CI here proves the plugin resolves and configures under Gradle 9.7.1, and nothing more. That is a genuine signal (a plugin that broke Gradle 9 configuration would fail the build), just a much narrower one than the checkmark suggests. Same posture as the four prior bumps in this series (1.1.6, 1.1.9, 1.1.10, 1.1.11), which all landed on the same evidence, so this is not a new gap this PR introduces.

The setup is in fact dormant end to end: ProcessSpawner.buildCommand reads config.nativeImagePath (modules/boss-process-manager/src/main/kotlin/ai/rever/boss/process/ProcessSpawner.kt:126-133) and falls back to JVM mode when it is null, and the only producer of that value is manifest.nativeImagePath from a plugin manifest (composeApp/src/desktopMain/kotlin/ai/rever/boss/components/plugin/OutOfProcessPluginSpawnerImpl.kt:154). Nothing feeds a nativeCompile output into it. These bumps are maintenance on a path nothing exercises.

If a native smoke job is ever wanted, the launcher-discovery change is precisely the thing to check first, since it alters how the plugin locates native-image (explicit launcher vs toolchain convention). Nothing in this repo sets GRAALVM_HOME or a javaLauncher on the binaries, so there is no configuration here that #845 could reinterpret today. Add a native-image smoke job → - scope call for you, not something this PR should carry.

Checks that came back clean

Concern	Finding
Test-classpath side effects	Native Build Tools attaches junit-platform-native only when JUnit Platform is on the test classpath. Every one of the nine modules uses libs.kotlin.test.junit (JUnit 4), so ./gradlew test semantics are untouched by any version of this plugin.
Gradle compatibility	Wrapper is 9.7.1. 1.1.11 already configures cleanly on it (it is on dev), and 1.1.12 is a patch with no Gradle API change in its changelog.
Kotlin/Compose alignment	No interaction surface. graalvmNative is only ever applied next to kotlinJvm, never on a KMP or Compose module - composeApp and server do not apply it - and the plugin contributes no Kotlin stdlib or Compose runtime constraint. Nothing to align.
Native classifiers	Not applicable to this artifact. The classifier hazards in this repo are protoc / protoc-gen-grpc-java (the reason for the Windows-ARM64 exclusion) and JxBrowser. native-gradle-plugin is a single classifier-less jar from the Plugin Portal, identical on every OS, as is the reachability-metadata artifact it pulls.
Security	Patch bump within the same upstream group, resolved from gradlePluginPortal() (settings.gradle.kts pluginManagement). No CVE and no security fix claimed in the 1.1.12 notes. Worth noting the repo has no gradle/verification-metadata.xml and no dependency locking, so there are no checksums to regenerate - and equally nothing pinning this plugin's bytes. That is pre-existing posture, unchanged by this PR.
Behavioural regression in the app	None reachable. The plugin is build-time only and contributes nothing to any shipped artifact; release.yml runs createDistributable / packageDmg / packageMsi / packageDeb, none of which touch it.

What I could not verify

• I could not fetch origin/dev in this sandbox (network-restricted), so I reviewed the branch tree and its single commit against its merge base rather than doing a literal git diff origin/dev...HEAD. Given the change is one catalog line and the PR reports +1/-1 across one file, the risk of that mattering is low, but the base-branch comparison is inferred rather than executed.
• I could not run Gradle locally (plugin resolution needs network), so configuration under 1.1.12 is unverified here. CI's ./gradlew build covers exactly that, and it is the check to watch on this PR.

---  ·  Branch dependabot/gradle/org.graalvm.buildtools.native-1.1.12

[kshivang]

Review resolution and validation

The one GraalVM plugin ref moves all nine JVM microkernel consumers to 1.1.12. Upstream changes affect native-image discovery and reachability metadata 1.0.13, without a Kotlin/Compose/classifier change. CI and local integration configuration validate Gradle 9.7.1 compatibility. No repository build/release workflow invokes nativeCompile; native executable generation remains untested, explicitly not claimed as covered. Claude found no substantive blocker; an opt-in native-image smoke job is a useful separate follow-up.

Original work remains entirely Dependabot-authored; no source repairs for this PR. The initial head passed all ten CI checks, including all three platform builds, quality and compatibility. Local isolated integration 90902cd81 on dev 3e09b57 plus the four distinct dependency updates passed 4,685 desktop tests (one skipped) and 49 IPC tests. After dev advanced to 2714a6a through #648, #509 and #646, a second isolated run passed their focused regressions, Essenty lifecycle tests and the logging/bookmark/workspace Compose stable-field tests on combined tree e6e51b455. No conflict or dependency catalog change was introduced by those merges. Bot contribution score: N/A. No application or database deployment was run.