Declare Timber directly instead of via LogcatCoreLib

[davidschreiber]

What

Replaces the LogcatCoreLib dependency of the tracker module with a direct dependency on Timber.

- implementation "com.github.AppDevNext.Logcat:LogcatCoreLib:3.4"
+ implementation "com.jakewharton.timber:timber:5.0.1"

Why

The tracker uses Timber for its logging (67 call sites across 16 files) but never declares it — Timber
arrives transitively, because LogcatCoreLib exposes it at compile scope. No class from
info.hannes.* is referenced anywhere in tracker/src/main, so the library itself is unused here.

Declaring Timber directly makes that dependency explicit and drops four transitive artifacts from
every app that integrates the SDK:

com.github.AppDevNext.Logcat:LogcatCoreLib:3.4
├── com.jakewharton.timber:timber:5.0.1          <- the only one actually used
├── org.jetbrains.kotlinx:kotlinx-coroutines-android:1.10.2
├── androidx.lifecycle:lifecycle-runtime-ktx:2.9.3
├── androidx.lifecycle:lifecycle-livedata-ktx:2.9.3
└── org.jetbrains.kotlin:kotlin-stdlib-jdk8:2.2.10

For apps that ship an open source attribution screen, each of those also means one more entry to
track and keep licensed — which is how we noticed.

5.0.1 is the version that was already being resolved transitively, so the Timber version on the
classpath does not change.

Scope

The exampleapp module keeps LogcatCoreLib: it genuinely uses it (DemoApp.kt installs
info.hannes.timber.DebugFormatTree). This change only touches the published tracker module.

Verification

Ran the same steps as the PR CI, all green:

• ./gradlew assembleDebug
• ./gradlew check — 454 tests, 0 failures
• ./gradlew :tracker:assembleRelease

[aikido-pr-checks]

CVE-2022-24329 in org.jetbrains.kotlin:kotlin-stdlib - medium severity
In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects.

Details

Remediation Aikido suggests bumping this package to version 1.6.0 to resolve this issue

_{Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info}

[hannesa2]

You are too late 😁 I did it some minutes before #643

[davidschreiber]

Alright, @hannesa2 even better! 👍🏼 Thanks a lot! I'll close mine then.