Merge master into staging

.github/dependabot.yml

@@ -1,10 +1,17 @@
 version: 2
 updates:
-  # Gradle dependencies. org.json is declared separately in sdk-java, app-java
-  # and app-javafx; Dependabot opens one PR per module, so check that a bump
-  # lands everywhere before closing the others.
+  # Gradle dependencies. org.json is declared separately in sdk-java, sdk-java-ui,
+  # app-java and app-javafx; Dependabot opens one PR per module, so check that a
+  # bump lands everywhere before closing the others. A bump of a published
+  # dependency also has to update .github/release-contract/, or the release
+  # checks fail.
+  #
+  # Releases are tagged on staging, so version updates target staging; master
+  # receives them with the next release. Security updates still open against
+  # master, so merge master into staging after taking one.
   - package-ecosystem: gradle
     directory: "/"
+    target-branch: staging
     schedule:
       interval: weekly
       day: monday
@@ -16,6 +23,7 @@ updates:
 
   - package-ecosystem: github-actions
     directory: "/"
+    target-branch: staging
     schedule:
       interval: monthly
     labels:

.github/release-contract/java-ui.json

@@ -3,7 +3,7 @@
   "coordinates": "ly.count.sdk:java-ui",
   "pomDependencies": [
     "ly.count.sdk:java:{version}:compile",
-    "org.json:json:20250517:runtime",
+    "org.json:json:20260814:runtime",
     "org.openjfx:javafx-controls:21.0.5:runtime",
     "org.openjfx:javafx-web:21.0.5:runtime"
   ],

.github/release-contract/java.json

@@ -3,7 +3,7 @@
   "coordinates": "ly.count.sdk:java",
   "pomDependencies": [
     "com.google.code.findbugs:jsr305:3.0.2:runtime",
-    "org.json:json:20250517:runtime"
+    "org.json:json:20260814:runtime"
   ],
   "moduleVariantAttributes": {
     "org.gradle.jvm.version": 8

.github/workflows/coverage.yml

@@ -104,7 +104,7 @@ jobs:
       # pull-requests: write.
       - name: Comment the report on the pull request
         if: always() && github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const fs = require('fs');

.github/workflows/dependency-security.yml

@@ -79,7 +79,7 @@ jobs:
       # instead of adding a new one on every push.
       - name: Comment scan result on the pull request
         if: always() && github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const fs = require('fs');
@@ -175,7 +175,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Fail the PR on newly introduced vulnerable dependencies
-        uses: actions/dependency-review-action@v4
+        uses: actions/dependency-review-action@v5
         with:
           fail-on-severity: low
           comment-summary-in-pr: on-failure

.github/workflows/release.yml

@@ -220,8 +220,11 @@ jobs:
     permissions: {}
     steps:
       - name: Slack
-        uses: slackapi/slack-github-action@007b2c3c751a190b6f0f040e47ed024deaa72844 # v1.23.0
+        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
         with:
+          errors: true
+          webhook: ${{ secrets.SLACK_RELEASE }}
+          webhook-type: webhook-trigger
           payload: |
             {
               "repository": "${{ github.repository }}",
@@ -230,15 +233,13 @@ jobs:
               "body": ${{ toJSON(github.event.release.body) }},
               "html_url": "${{ github.event.release.html_url }}"
             }
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_RELEASE }}
       - name: Discord
-        uses: sarisia/actions-status-discord@9904e3130b8905d5b973df25623f17672dcb3466 # v1.13.0
+        uses: sarisia/actions-status-discord@eb045afee445dc055c18d3d90bd0f244fd062708 # v1.16.0
         with:
           webhook: ${{ secrets.DISCORD_WEBHOOK_URL }}
           nodetail: true
           title: New ${{ github.repository }} version ${{ github.event.release.tag_name }} published by ${{ github.actor }}
           description: |
             Release URL: ${{ github.event.release.html_url }}
-            Click [here](https://github.com/Countly/countly-server/blob/master/CHANGELOG.md) to view the change log.
+            Click [here](${{ github.server_url }}/${{ github.repository }}/blob/${{ github.event.release.tag_name }}/CHANGELOG.md) to view the change log.
             `${{ github.event.release.body }}`

.github/workflows/validate_gradle.yml

@@ -16,4 +16,4 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: gradle/wrapper-validation-action@v2
+      - uses: gradle/wrapper-validation-action@v3

CHANGELOG.md

@@ -20,6 +20,8 @@
   ```
   Versions released before this one stay available on Maven Central. The files are signed with the same key as before (`FC8DB0DE234A273BA45E562FB8C83A079A5BBD0C`).
 
+* Updated JSON library version from "20250517" to "20260814".
+
 ## 26.8.0
 * Added support for the Content feature, accessible through the "Countly.instance().content()" interface:
   * "enterContentZone" / "exitContentZone" for starting and stopping periodic content fetching

app-java/build.gradle

@@ -9,7 +9,7 @@ repositories {
 }
 
 dependencies {
-  implementation 'org.json:json:20250517'
+  implementation 'org.json:json:20260814'
 
   implementation fileTree(dir: 'libs', include: ['*.jar'])
   implementation project(path: ':sdk-java')

app-javafx/build.gradle

@@ -26,7 +26,7 @@ dependencies {
 
     // org.json is used by the demo for pretty-printing widget data; the
     // SDK also uses it internally (and exposes JSONObject in its API).
-    implementation 'org.json:json:20250517'
+    implementation 'org.json:json:20260814'
 }
 
 application {

sdk-java-ui/build.gradle

@@ -62,9 +62,9 @@ dependencies {
   // appear in this package's public signatures.
   api project(':sdk-java')
 
-  implementation 'org.json:json:20250517'
+  implementation 'org.json:json:20260814'
 
-  testImplementation 'junit:junit:4.13.1'
+  testImplementation 'junit:junit:4.13.2'
   testImplementation 'org.mockito:mockito-core:4.11.0'
 }
 

sdk-java/build.gradle

@@ -18,10 +18,10 @@ if (JavaVersion.current().isJava9Compatible()) {
 }
 
 dependencies {
-  implementation 'org.json:json:20250517'
+  implementation 'org.json:json:20260814'
   implementation 'com.google.code.findbugs:jsr305:3.0.2'
 
-  testImplementation 'junit:junit:4.13.1'
+  testImplementation 'junit:junit:4.13.2'
   testImplementation 'org.mockito:mockito-core:4.11.0'
   //testImplementation 'com.squareup.okhttp3:mockwebserver:3.7.0'
 }