Skip to content

build(deps): bump the gradle-dependencies group across 1 directory with 5 updates - #142

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/gradle/gradle-dependencies-13d0b0c4ba
Closed

build(deps): bump the gradle-dependencies group across 1 directory with 5 updates#142
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/gradle/gradle-dependencies-13d0b0c4ba

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the gradle-dependencies group with 5 updates in the / directory:

Package From To
com.google.firebase:firebase-bom 34.15.0 34.16.0
com.android.application 9.2.1 9.3.1
com.android.test 9.2.1 9.3.1
org.jetbrains.kotlin.plugin.serialization 2.4.0 2.4.10
com.google.devtools.ksp 2.3.9 2.3.10

Updates com.google.firebase:firebase-bom from 34.15.0 to 34.16.0

Updates com.android.application from 9.2.1 to 9.3.1

Updates com.android.test from 9.2.1 to 9.3.1

Updates com.android.test from 9.2.1 to 9.3.1

Updates org.jetbrains.kotlin.plugin.serialization from 2.4.0 to 2.4.10

Release notes

Sourced from org.jetbrains.kotlin.plugin.serialization's releases.

Kotlin 2.4.10

Changelog

Backend. Wasm

  • KT-87066 K/Wasm: Not all files are presented in compiler output directory with multimodule-closed-world and incremental compilation

Compiler

  • KT-86939 JVM: IllegalStateException "No value for annotation parameter" when using const val in nested Java annotation array argument
  • KT-83766 K2: Wrong sourcePsi is set for SymbolPsiLiteral in SLC for annotation arguments referencing a const val
  • KT-86728 Reified type inference: expected type not propagated into inline call inside lambda with elvis operator

Compose Compiler

  • b/522127447 Compose Compiler 2.4: classes previously inferred stable now reported runtime/Uncertain

Klibs

  • KT-86501 Native: IrTypeAliasSymbolImpl is already bound. Signature: kotlinx.datetime/Instant|null[0] on iosSimulatorArm64

Tools. CLI

  • KT-86930 Introduce kotlinr in the Kotlin distribution

Tools. Gradle. BCV

  • KT-87223 Gradle, BCV: open version range in kotlinAbiValidationCompatClasspath causes kotlin-build-tools-impl to resolve to 2.4.20-Beta1 instead of 2.4.0

Tools. Gradle. JS

  • KT-87304 jsBrowserTest fails with "exited with errors (exit code: 1)"
  • KT-86057 kotlinUpgradeYarnLock skips lock file regeneration when kotlinNpmInstall is up-to-date, causing kotlinStoreYarnLock to fail

Tools. Gradle. Multiplatform

  • KT-87084 False positive warning for JS and Wasm compilations when CRI is enabled

Tools. Scripts

  • KT-87076 @file:CompilerOptions("-jvm-target", ...) ignored in .main.kts scripts in Kotlin 2.4.0, falling back to JVM target 1.8
  • KT-86352 K2 scripting: FirResolvedTypeRef exception when resolving extension functions from imported scripts

Kotlin 2.4.10-RC2

Changelog

Backend. Wasm

  • KT-87066 K/Wasm: Not all files are presented in compiler output directory with multimodule-closed-world and incremental compilation

... (truncated)

Changelog

Sourced from org.jetbrains.kotlin.plugin.serialization's changelog.

2.4.10

Backend. Wasm

  • KT-87066 K/Wasm: Not all files are presented in compiler output directory with multimodule-closed-world and incremental compilation

Compiler

  • KT-86939 JVM: IllegalStateException "No value for annotation parameter" when using const val in nested Java annotation array argument
  • KT-83766 K2: Wrong sourcePsi is set for SymbolPsiLiteral in SLC for annotation arguments referencing a const val
  • KT-86728 Reified type inference: expected type not propagated into inline call inside lambda with elvis operator

Compose Compiler

  • b/522127447 Compose Compiler 2.4: classes previously inferred stable now reported runtime/Uncertain

Klibs

  • KT-86501 Native: IrTypeAliasSymbolImpl is already bound. Signature: kotlinx.datetime/Instant|null[0] on iosSimulatorArm64

Tools. CLI

  • KT-86930 Introduce kotlinr in the Kotlin distribution

Tools. Gradle. BCV

  • KT-87223 Gradle, BCV: open version range in kotlinAbiValidationCompatClasspath causes kotlin-build-tools-impl to resolve to 2.4.20-Beta1 instead of 2.4.0

Tools. Gradle. JS

  • KT-87304 jsBrowserTest fails with "exited with errors (exit code: 1)"
  • KT-86057 kotlinUpgradeYarnLock skips lock file regeneration when kotlinNpmInstall is up-to-date, causing kotlinStoreYarnLock to fail

Tools. Gradle. Multiplatform

  • KT-87084 False positive warning for JS and Wasm compilations when CRI is enabled

Tools. Scripts

  • KT-87076 @file:CompilerOptions("-jvm-target", ...) ignored in .main.kts scripts in Kotlin 2.4.0, falling back to JVM target 1.8
  • KT-86352 K2 scripting: FirResolvedTypeRef exception when resolving extension functions from imported scripts
Commits
  • 5687445 Add Changelog for 2.4.10-RC2
  • ba30392 [Wasm] Support regenerate unchanged modules flag on KGP
  • 6307e73 [Wasm] Implement Xwasm-IC-generate-unchanged-modules flag
  • 39d7aee Add ChangeLog for 2.4.10-RC2
  • a2956be [Gradle] Update karma.conf.js to use 'require(...)' instead plain strings
  • 9b1361c [Gradle] KT-87223: Updated regression test
  • a4c153a [Gradle] KT-87223: Fix toochain to 2.4.0 for abiValidation compat config
  • bc04b90 Add ChangeLog for 2.4.10-RC
  • bbcb94b [CRI] explicitly disable CRI generation for non-JVM targets to avoid false-po...
  • 6c2c458 Scripting: fix jvmTarget processing from script annotations
  • Additional commits viewable in compare view

Updates com.google.devtools.ksp from 2.3.9 to 2.3.10

Release notes

Sourced from com.google.devtools.ksp's releases.

2.3.10

What's Changed

  • Fix OOMs caused by unstopped coroutine Dispatcher threads by moving KSP task cache to a gradle build service (#2817)
  • Sanitize ':' in internal-name module suffix so KSP works with Kotlin 2.4.0 default module names (#2964)
  • Filter source file trees in KspAATask to restore NO-SOURCE skipping behaviour (#2947)
  • Fix R-class resolution in KSP when AGP 9 built-in Kotlin is enabled (#2857)
  • Fix KSP2 incremental cache path normalization mismatch (#2854)
  • Normalize line endings for KspAATask source roots to prevent cross-platform remote build cache misses (#2849)
  • Fix bug where KSP incremental compilation does not consider library class references in annotations (#3011)
  • Consume all Kotlin sources in KSP to support other code generators (#3001)
  • Fix configuration cache invalidation in klib cross-compilation check (#3014)
  • Memoized hash code for KSTypeImpl to speed up processing (#2896)
  • Fix incorrect name generation for data classes annotated with @JvmRecord (#2813)
  • Include kotlinx.coroutines in the distributed uber jar symbol-processing-aa-embeddable (#2938)
  • New debugging features for incremental compilation, including additional logging and dependency graph visualization (#3015)
  • Deprecate the ksp(...) Gradle configuration in Kotlin Multiplatform (KMP) projects in favor of target-specific configurations (#2956). Note: Non-KMP projects are also affected. For migration details, see the documentation.

Contributors

Full Changelog: google/ksp@2.3.9...2.3.10

Commits
  • ccf45ce Remove unreachable code
  • e1f7634 Rename tpe to kaType
  • b29f39b Make calcValue's parent parameter non-nullable
  • fcbd0a5 Record references to classes in annotation arguments
  • caea1d4 Add integration test for module names
  • 35a2599 Add logging for dependency graph
  • f28914d Clean up module name tests
  • 04666c1 fix: sanitize ':' in internal-name module suffix so KSP 2.3.9 works with Kotl...
  • abea428 Add negative test for incremental compilation
  • e0c0033 Qualify shadowing name
  • Additional commits viewable in compare view

@dependabot @github

dependabot Bot commented on behalf of github Jul 15, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@emir-hasanbegovic emir-hasanbegovic mentioned this pull request Jul 17, 2026
Merged
emir-hasanbegovic added a commit that referenced this pull request Jul 21, 2026
@emir-hasanbegovic @EmirWebTravis
fix + chore: send-counter nonce-reuse guard; warning + CI-hygiene swe…
5329309 
…ep (#145)

## Summary

Two layers on one branch (maintainer's one-branch preference for the
2026-07-20 fix wave):

1. **Warning + CI-hygiene sweep** (`fa1c35e`, `9bd9cac`, `f897948`,
`da24efe`): clears the compiler/native/lint warnings surfaced by the
last green CI build and a full uncached local gate run, and caps
workflow jobs with runtime timeouts. No dependency-version changes.
2. **Fix-wave security fix + sweep follow-ups** (`c802f8e`, `090574b`,
`bbd5d4a`, `7bacf09`): a serious UDP send-counter wrap fix (ChaCha20
nonce reuse), plus review follow-ups on the sweep itself. **The branch
is no longer behavior-neutral** — `c802f8e` changes the crypto send path
and session lifecycle.

## What changed

**SERIOUS fix: send-counter wrap → nonce reuse (`c802f8e`)**
- `satellite_jni.cpp` drew the ChaCha20-Poly1305 nonce counter from a
`uint32 fetch_add` with no exhaustion guard: at 2^32 packets in one
unbroken session it wrapped and re-sealed under reused (key, nonce)
pairs until heartbeat death (contract §Crypto forbids exactly this;
horizon ~50 days at 1 kHz).
- Mirrors dish-mac / dish-linux: the send path draws from a 64-bit
counter (`send_counter.h`) and goes **silent** past 2^32−1;
`getSendCounter()` clamps at the wire max; the 1 Hz Kotlin alive-poll
fires a single-shot `onRekeyNeeded` once the counter crosses
`0xF0000000` (`counterNeedsRepush`); the manager re-PUTs the session for
fresh token/salt/key, restarting the counter at 1 long before
exhaustion.
- Tests: 7 host gtests pin the guard across the exhaustion boundary
(silence, no counter value ever repeats under one key, clamped view —
all fail against the old wrap semantics); 5 JVM tests pin the threshold
predicate, the single-shot latch + re-arm, and the manager re-PUT
installing fresh params exactly once. `runMgrTest` now tears sessions
down in a `finally` (an assertion failure used to skip teardown and spin
the virtual-time drain into OOM).

**Sweep follow-ups (review findings on this PR)**
- `090574b` — the sweep's class-wide test `@Suppress("DEPRECATION")` did
**not** match production (which scopes to the call site) and would have
masked any new deprecation in those classes. Narrowed to the exact
legacy call sites in `RumbleRouterTest`, `BluetoothConnectionsTest`,
`BluetoothDeviceScannerTest`, `BluetoothBondMonitorTest`.
- `bbd5d4a` — the sweep claimed every job was capped, but the five
`_security.yml` jobs had no `timeout-minutes`. Capped at 10 min each
(warm runtimes 5–10 s). The sibling repos' copies of the shared file are
still uncapped — cross-repo sync is a follow-up.
- `7bacf09` — `HAVE_SYSCONF=1` was justified only as warning-silencing;
it is a behavior change to libsodium (runtime page size via `sysconf`
for `sodium_mlock`/guarded allocations — what Android 15's 16 KB-page
devices need). The comment now says so. Not exercisable in the host
gtest harness; on-device coverage rides the emulator integration suite.

**Native / build (`fa1c35e`)**
- `CMP0135` policy set explicitly (`NEW`), removing the
`DOWNLOAD_EXTRACT_TIMESTAMP` FetchContent dev warning.
- `HAVE_SYSCONF=1` for the vendored libsodium build (see `7bacf09` above
for the real rationale). NDK debug build is **0 native warnings**.

**Kotlin + Android Lint (`9bd9cac`)** — 12 production Kotlin compiler
warnings cleared (these were hidden in CI by the Gradle build cache; an
uncached `--rerun-tasks` compile surfaces them): unused expression
results, override param-name mismatches, deprecated-override annotations
on mandatory `Drawable.getOpacity()` overrides, a K2 always-true
condition, unnecessary safe-calls after smart-casts, and one Java
platform-type nullability. Plus 3 Lint fixes: `EmptySuperCall`,
`ObsoleteSdkInt`, `UseKtx`.

**Workflow hygiene (`f897948`)** — added `timeout-minutes` to the
dish-android-owned jobs (build 30, play-listing 20, play-reviews 15,
release jobs 10–60); `bbd5d4a` completes the claim for `_security.yml`.
All 13 action pin-map `tag→SHA` comments verified against upstream (none
stale). 40-char SHA pins kept.

**Comment trim (`da24efe`)** — sweep-added comments cut to terse
why-only house style.

## Test evidence (branch head `7bacf09`)

All CI gates re-run locally at this head: clang-format (22.1.5 local vs
22.1.4 CI pin — no diffs), Play-metadata lint, ktlint + detekt, Android
Lint, **1,542 JVM unit tests (0 failures)**, **166/166 native tests**,
`assembleDebug` + `assembleDebugAndroidTest` — all green; native build
and all touched Kotlin files warning-clean. Fail-before verified for the
counter fix: neutering the guard fails 4 native tests; neutering the
predicate fails 3 connection tests + the manager re-PUT test.

## Deliberately deferred (out of scope)

- **Parked #142 dependency group** (AGP 9.3.0 / Kotlin 2.4.10 /
firebaseBom 34.16.0) — CodeQL CLI rejects Kotlin 2.4.10; the 2
`AndroidGradlePluginVersion` + 1 `GradleDependency` Lint warnings stay
until CodeQL supports it.
- **116-item Lint backlog** (UnusedResources, ContentDescription, i18n,
etc.) — pre-existing, regression-risky to churn en masse; recommend a
dedicated QA-reviewed cleanup.
- **15 pre-existing test/main warnings** (deprecated internal
`PhysicalReachability` object usages, 2 USELESS_CAST,
platform-nullability) — pre-date this branch; naive fixes trade one
warning for another; recommend a focused pass.
- **Plugin-internal Gradle deprecations**
(ktlint/detekt/baselineprofile) — not fixable in first-party build
scripts.
- Strict mode (`allWarningsAsErrors` / lint `warningsAsErrors`) is
**not** enabled yet — recommended once the above land and the tree is
fully clean.
- `_security.yml` timeout caps for the sibling repos' copies of the
shared workflow — sync convention follow-up.

## Unverified

- The instrumented **FakeSatellite integration suite**
(`connectedDebugAndroidTest`) runs only on an emulator/CI — this PR's CI
run is the arbiter. The re-key path itself is unit-tested at the
JNI-boundary seam; the end-to-end rotation against a live satellite
rides the existing session-PUT integration coverage.
- Local gates ran under the Android Studio JBR (JDK 21; no JDK 17 on the
build host) with bytecode target JVM 17; CI uses temurin 17. No
JDK-21-only warnings were observed.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Emir Hasanbegovic <phigammemir@gmail.com>
@dependabot dependabot Bot changed the title build(deps): bump the gradle-dependencies group with 5 updates build(deps): bump the gradle-dependencies group across 1 directory with 5 updates Jul 22, 2026
@dependabot
dependabot Bot force-pushed the dependabot/gradle/gradle-dependencies-13d0b0c4ba branch from 49df317 to 7a9bb57 Compare July 22, 2026 01:55
@dependabot
build(deps): bump the gradle-dependencies group across 1 directory wi…
7bfff89 
…th 5 updates

Bumps the gradle-dependencies group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| com.google.firebase:firebase-bom | `34.15.0` | `34.16.0` |
| com.android.application | `9.2.1` | `9.3.1` |
| com.android.test | `9.2.1` | `9.3.1` |
| [org.jetbrains.kotlin.plugin.serialization](https://github.com/JetBrains/kotlin) | `2.4.0` | `2.4.10` |
| [com.google.devtools.ksp](https://github.com/google/ksp) | `2.3.9` | `2.3.10` |



Updates `com.google.firebase:firebase-bom` from 34.15.0 to 34.16.0

Updates `com.android.application` from 9.2.1 to 9.3.1

Updates `com.android.test` from 9.2.1 to 9.3.1

Updates `com.android.test` from 9.2.1 to 9.3.1

Updates `org.jetbrains.kotlin.plugin.serialization` from 2.4.0 to 2.4.10
- [Release notes](https://github.com/JetBrains/kotlin/releases)
- [Changelog](https://github.com/JetBrains/kotlin/blob/master/ChangeLog.md)
- [Commits](JetBrains/kotlin@v2.4.0...v2.4.10)

Updates `com.google.devtools.ksp` from 2.3.9 to 2.3.10
- [Release notes](https://github.com/google/ksp/releases)
- [Commits](google/ksp@2.3.9...2.3.10)

---
updated-dependencies:
- dependency-name: com.android.application
  dependency-version: 9.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle-dependencies
- dependency-name: com.android.test
  dependency-version: 9.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle-dependencies
- dependency-name: com.android.test
  dependency-version: 9.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle-dependencies
- dependency-name: com.google.devtools.ksp
  dependency-version: 2.3.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gradle-dependencies
- dependency-name: com.google.firebase:firebase-bom
  dependency-version: 34.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle-dependencies
- dependency-name: org.jetbrains.kotlin.plugin.serialization
  dependency-version: 2.4.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gradle-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/gradle/gradle-dependencies-13d0b0c4ba branch from 7a9bb57 to 7bfff89 Compare July 29, 2026 01:55
@dependabot @github

dependabot Bot commented on behalf of github Aug 12, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Aug 12, 2026
@dependabot
dependabot Bot deleted the dependabot/gradle/gradle-dependencies-13d0b0c4ba branch August 12, 2026 01:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants