chore: update patch-level dependencies (Firebase BOM, SKIE, Spotless, Kover, Lifecycle) - #301
Open
kirich1409 wants to merge 18 commits into
Open
chore: update patch-level dependencies (Firebase BOM, SKIE, Spotless, Kover, Lifecycle)#301kirich1409 wants to merge 18 commits into
kirich1409 wants to merge 18 commits into
Conversation
The Analyze Kotlin job failed with 'no source code seen during build' (exit code 32): assembleDebug compile tasks were served from cache / marked UP-TO-DATE, so CodeQL's tracer observed no Kotlin source. Add --no-build-cache --rerun-tasks to the CodeQL build step to force actual recompilation, giving the tracer source to analyze. Co-authored-by: Claude <noreply@anthropic.com>
- Bump VERSION_NAME to 1.0.0 - Add [1.0.0] CHANGELOG entry (Android-facing API as primary stable target) - Fix mkdocs: exclude cc-verification/specs, add Known Limitations to nav, move iOS guides to "iOS Preview" section, update site_description - Add "Stable in 1.0" admonition to Android guide - Add "Preview" admonitions to iOS guides - Fix CodeQL workflow: build-mode=manual + --no-build-cache --rerun-tasks
* test(shrinker): cover -keep defeating flag dead-code elimination A consumer -keep rule (often a broad wildcard or @keep) that covers a flag-guarded class defeats R8 tree-shaking: -assumevalues still folds the disabled branch (behaviour unchanged), but the class itself is pinned as an unconditional GC root and ships in the APK despite being unreachable — silently losing the size benefit of build-time flags. - Add writeBooleanRulesWithKeptDeadBranch() modelling the pitfall - Add a regression test asserting the dead-branch class survives the keep - Document the two-phase elimination model and keep-rule guidance in the R8 verification guide * test(shrinker): assert branch folding in keep regression; fix docs Address review feedback on the -keep regression test and guide: - The keep test now also asserts BifurcatedCaller no longer references IfBranchCode, proving R8 still folded the disabled branch (phase 1) rather than only keeping the class alive via the kept caller. Adds assertClassDoesNotReference() (ASM bytecode inspection). - Move -dontoptimize out of the 'not a problem' list in the R8 guide into a distinct hazard note — it suppresses elimination and must not be grouped with the harmless accessor-method keep. --------- Co-authored-by: Claude <noreply@anthropic.com>
* Publish Gradle plugin to Plugin Portal, keep Central listing clean (#228) Apply com.gradle.plugin-publish so the two java-gradle-plugin marker artifacts (incl. the second groupId) are hosted on the Gradle Plugin Portal via publishPlugins. Disable the marker -> Maven Central tasks so the Central listing carries only the clean featured-gradle-plugin impl jar (+ sources/javadoc/pom). Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Publish plugin to Gradle Plugin Portal on tagged releases Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Isolates Portal publication so a re-run never re-triggers the Maven Central step. Adds workflow_dispatch with required ref/version inputs so the v1.0.0 tag can be published retroactively. Root cause fixed: the missing GPG signing env (ORG_GRADLE_PROJECT_signingInMemoryKey*) is now present alongside Portal creds, resolving the signatory error on marker publications.
# Conflicts: # Package.swift
Backport of #245 to main so the re-created v1.1.1 tag publishes the deployment as USER_MANAGED (manual promotion in the Portal) instead of auto-releasing, which was failing with 403 on the build-service upload. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
ci: upload to Central Portal as USER_MANAGED, drop auto-release
# Conflicts: # .github/workflows/publish.yml
… Kover, Lifecycle) - firebaseBom: 34.14.1 → 34.16.0 (2 patch releases, security/bug fixes) - skie: 0.10.12 → 0.10.14 (2 patch releases) - spotless: 8.6.0 → 8.9.0 (patch series within 8.x) - kover: 0.9.8 → 0.9.9 (patch release) - androidx-lifecycle: 2.10.0 → 2.11.0 (minor; scoped ViewModels, KMP targets for lifecycle-viewmodel-compose) Note: Kotlin 2.3.21 is affected by CVE-2026-53914 (CVSS 6.7). Fix requires Kotlin ≥ 2.4.20, currently in beta (stable expected September 2026). Also: Kotlin 2.4.10 and Compose Multiplatform 1.11.1 are available minor updates with breaking changes requiring a separate review. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014a2EDKSPwFvNLrENoHqnAX
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #
Type of change
Summary
Automated dependency audit (2026-08-03). Applied low-risk patch and minor updates. Flagged higher-risk updates and a security CVE for manual review below.
Applied updates
firebaseBomskie(SKIE Swift bridge)spotlesskoverandroidx-lifecycleandroidx-lifecycle2.11.0 adds scoped ViewModels in Compose and extends KMP targets forlifecycle-viewmodel-compose; no breaking changes to existing APIs.Affected: JetBrains Kotlin < 2.4.20 (project is on 2.3.21)
Type: CWE-502 — Unsafe deserialization of build cache metadata → code execution
Fix: Upgrade to Kotlin ≥ 2.4.20
Status: Kotlin 2.4.20 is currently at Beta2; stable is planned for September 2026. Updating to the current stable 2.4.10 does not fix this CVE. Additionally, GitHub Dependabot reports 45 known vulnerabilities on the default branch (2 critical, 17 high, 23 moderate, 3 low) — recommend reviewing
/security/dependabot.Pending manual-review updates (breaking changes)
These have breaking changes or require coordinated upgrades and are not included here:
kotlincomposeMultiplatformWebElementView→HtmlElementView; navigation no longer exposesandroidx.collectionas APIUp to date (no action needed)
agp9.2.1 ·kotlinx-coroutines1.11.0 ·kotlinx-serialization1.11.0 ·androidx-core1.19.0 ·androidx-activity1.13.0 ·androidx-appcompat1.7.1 ·androidx-datastore1.2.1 ·composeHotReload1.1.1 ·mockk1.14.11 ·robolectric4.16.1 ·turbine1.2.1 ·dokka2.2.0 ·detekt1.23.8 ·pluginPublish2.1.1Checklist
./gradlew spotlessCheckpassesNotes for reviewers
This PR contains only version bumps to
gradle/libs.versions.toml. No source code changes. The security CVE note above is the most important item for follow-up — track Kotlin 2.4.20 stable (est. September 2026) for the actual fix.Generated by Claude Code