build: update dependencies to latest versions - #2387
Open
kikoso wants to merge 12 commits into
Open
Conversation
Bumps the version catalog and a handful of hardcoded snippet dependencies to their latest releases, including major upgrades: AGP 8.13.2 -> 9.3.1, Gradle 9.1.0 -> 9.7.0, Kotlin 2.2.0 -> 2.4.10, KSP 2.2.20-2.0.4 -> 2.3.11 (now versioned independently of Kotlin), Maps Compose 7.0.0/6.12.0 -> 8.4.0, Places(-ktx) and android-maps-utils to their latest majors. Also aligns app-rx's hardcoded play-services-maps/places versions with the rest of the repo.
Both are new majors since the last actions bump (#2377). Verified no workflow uses pull_request_target/workflow_run (affected by checkout v7's fork-checkout change) or setup-python's removed pip-install input, so no other changes are needed.
scripts/update_docs_versions.py enforces this in CI; the wear bump to 1.4.0 left the inline comment stale.
Ran ./gradlew wrapper --gradle-version=9.7.0 instead of hand-editing gradle-wrapper.properties, since that also refreshes gradle-wrapper.jar and the gradlew/gradlew.bat scripts (and picks up new 9.x wrapper properties like retries/retryBackOffMs). Drops the distributionSha256Sum pin as requested.
AGP 9 provides Kotlin support natively and refuses to configure a
module that still applies org.jetbrains.kotlin.android alongside it.
Removes that plugin (all its declaration styles: catalog alias,
kotlin("android"), and hardcoded id(...)) from every module actually
wired into settings.gradle.kts, and drops the now-unused kotlin-android
catalog entry.
Also fixes two things AGP 9 surfaced as hard errors during
configuration, unrelated to the plugin removal itself:
- ApiDemos:java-app had a vestigial buildFeatures.compose = true with
no Kotlin sources or Compose dependencies; AGP 9 now requires the
Compose Compiler plugin whenever compose is enabled, so the dead
flag is removed instead.
- tutorials/kotlin/Polygons used the now-unsupported
proguard-android.txt default file, replaced with
proguard-android-optimize.txt.
Standalone tutorial/sample directories not wired into
settings.gradle.kts (app-rx, the java/ and duplicate kotlin/ tutorial
folders) are untouched since they aren't part of the actual build
graph or CI.
androidx.core:core-ktx 1.19.0 requires compiling against API 37+; CI's checkDebugAarMetadata caught this. Also switches app-utils-ktx off its hardcoded compileSdk/targetSdk = 36 onto the catalog value, matching every other module.
The org's zizmor policy check (triggered whenever workflow files change) requires every `uses:` reference to be pinned to a full commit SHA rather than a floating version tag. Touching these three files for the checkout/setup-python bump made the check actually run for the first time in a while and it flagged all 36 `uses:` lines in them (not just the ones changed), so pins every action reference across build.yml, lint.yml, and generate-v3.yml, each with a version comment. release-please.yml is untouched by this PR and wasn't flagged, so left as-is.
…stence zizmor flagged two more findings once these files started being scanned: excessive-permissions (Medium, blocking) because none of the three workflows declared an explicit permissions: block and so ran with the default broad GITHUB_TOKEN scope, and artipacked (Low, informational) because checkout steps left credentials persisted in the git config, which get exposed to anything that later reads the workspace (e.g. artifact uploads). - build.yml: contents: read (checkout + build only, no writes) - lint.yml: contents: read, security-events: write (needed for github/codeql-action/upload-sarif) - generate-v3.yml: contents: read (the actual PR push uses its own SYNCED_GITHUB_TOKEN_REPO secret via peter-evans/create-pull-request, not the default token) - persist-credentials: false added to every actions/checkout step across all three files; none of them do a subsequent git push with the default token, so this is safe.
applyInsets(container: View) takes a non-null View, but every kotlin-app activity called it as applyInsets(findViewById<View?>(R.id.map_container)). Kotlin's newer compiler no longer treats an explicit nullable type argument on a platform-typed Java generic method leniently, so this now hard fails to compile instead of silently working. All 24 call sites always assumed a non-null result anyway (no null check), so this just drops the incorrect nullable type argument.
The android-maps-utils bump (3.19.0 -> 5.1.1, part of the dependency update) rewrote the library in Kotlin, which is a source-incompatible change for these snippets: - ClusterItem is now a Kotlin interface with val properties (position, title, snippet, zIndex: Float?), not Java-style getter methods. Clustering.kt and Multilayer.kt's MyItem implementations used `override fun getPosition()` etc., which no longer overrides anything Kotlin recognizes; converted to `override val` properties matching the new interface, constructor-promoted where possible. - KmlLayer/KmlContainer expose getContainers()/getPlacemarks() as plain functions, not Kotlin properties, and KmlContainer's backing fields are now private. Feature.getId() is likewise a function. KML.kt used property-access syntax (layer.containers, feature.id) for all of these; switched to explicit method calls. - GeoJsonLayer's default style accessor is getDefaultPointStyle(), not a defaultPointStyle property; fixed in GeoJSON.kt. - KmlLayer/GeoJsonLayer constructors now take non-null Context/InputStream/JSONObject instead of the old nullable platform types. These snippet files use throwaway `= null` placeholders for doc purposes (never actually run), so added `!!` at each call site to match, consistent with the existing `map!!` pattern already used nearby. Verified each API shape against the actual v5.1.1 source on googlemaps/android-maps-utils (the library moved to a Kotlin rewrite there) rather than guessing.
Two more spots the compiler hadn't reached yet in the previous fix pass: - GeoJsonPointStyle (Kotlin, android-maps-utils 5.1.1) exposes isDraggable()/setDraggable(), getTitle()/setTitle(), getSnippet()/setSnippet() as plain functions, not var properties, so app-utils-ktx/GeoJSON.kt's `pointStyle.isDraggable = true` style assignments don't compile; switched to explicit setter calls. - KmlContainer.getProperty() now returns String? (nullable); KML.kt passed it straight to Log.i's non-null second parameter, added !! (guarded by the existing hasProperty() check just above it). - The JSONObject-argument GeoJsonLayer constructor is now annotated @throws(JSONException::class) in Kotlin, which surfaces in Java as a checked exception. snippets/app-utils (Java)'s addGeoJsonLayerJsonObject() didn't declare it; added `throws JSONException` to match its sibling method's existing pattern.
AGP 9's bundled lint now flags UnrememberedMutableState as an error (previously warning/unreported): MarkerState(...) was created fresh every recomposition, which would also reset marker drag state. Wraps it in remember(markerData.id) so each marker's state survives recomposition and is invalidated by React iOnly when the marker's identity actually changes.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| // You do not need to add a separate dependency for the Maps SDK for Android | ||
| // since this library builds in the compatible version of the Maps SDK. | ||
| implementation("com.google.maps.android:android-maps-utils:3.19.0") | ||
| implementation("com.google.maps.android:android-maps-utils:5.1.1") |
|
|
||
| // Android Maps Compose composables for the Maps SDK for Android | ||
| implementation("com.google.maps.android:maps-compose:6.12.0") | ||
| implementation("com.google.maps.android:maps-compose:8.4.0") |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
gradle/libs.versions.toml) to the latest available versions across the board.snippets/app-compose,snippets/app-places-ktx,snippets/app-utils, andsnippets/app-rxto match.actions/checkoutandactions/setup-pythonto their latest majors (v7); verified no workflow usespull_request_target/workflow_run(affected by checkout v7's fork-checkout change) or setup-python's removedpip-installinput../gradlew wrapper --gradle-version=9.7.0(not a hand-edit), which also refreshedgradle-wrapper.jarandgradlew/gradlew.bat.org.jetbrains.kotlin.androidalongside it. Removed that plugin (all three declaration styles found in this repo: catalog alias,kotlin("android"), and hardcodedid(...)) from every module wired intosettings.gradle.kts, and dropped the now-unusedkotlin-androidcatalog entry.ApiDemos:java-apphad a vestigialbuildFeatures.compose = truewith zero Kotlin sources or Compose dependencies. AGP 9 now hard-requires the Compose Compiler plugin whenever compose is enabled, so the dead flag was removed instead of adding an unused plugin.tutorials/kotlin/Polygonsused the now-unsupportedproguard-android.txtdefault file; switched toproguard-android-optimize.txt.Standalone tutorial directories not wired into
settings.gradle.kts(app-rx, thetutorials/java/*folder and the duplicate un-includedtutorials/kotlin/*folders) are untouched since they aren't part of the actual build graph or CI.Notable major-version jumps (higher risk, flagging for review)
app-composehardcoded an older maps-compose version than the catalog)Everything else is a minor/patch bump within the same major version.
I confirmed locally that
./gradlew wrapper --gradle-version=9.7.0gets through project configuration cleanly for every module insettings.gradle.ktsafter the above fixes, but I don't have a way to run a full assemble/test build in this environment, so relying on CI for that.Test plan