[ThoSap]

Why

Gradle 9.9.1 fixes three security vulnerabilities that affect all versions up to 9.9.0 (release notes):

• GHSA-3cfg-jpcr-gfp3 (critical): version catalog values run as code in the generated accessors.
• GHSA-gqrr-4j89-5267 (high): the Gradle client trusts the content of the daemon registry.
• GHSA-pcp8-98xm-c6pr (high): the daemon client trusts stale registry entries (port squatting).

What changed

• The Gradle Wrapper goes from 9.9.0 to 9.9.1 (bin distribution). distributionSha256Sum is the value from the official checksum file, with the comment # https://gradle.org/release-checksums/ above it.
• gradlew, gradlew.bat and gradle-wrapper.jar stay the same: Gradle 9.9.1 generates the same files as 9.9.0.

Review notes

• 9.9.1 is a patch release with no new deprecation and no breaking change.
• 9.9.1 refuses version catalog values that contain */ or \u. No catalog of this project contains them.
• This project does not set org.gradle.daemon.registry.base.