Merge branch 'bump-android-dependencies'

Author: albin-mullvad

android/app/build.gradle.kts

@@ -33,7 +33,7 @@ android {
     compileSdk = Versions.Android.compileSdkVersion
 
     defaultConfig {
-        val localProperties = gradleLocalProperties(rootProject.projectDir)
+        val localProperties = gradleLocalProperties(rootProject.projectDir, providers)
 
         applicationId = "net.mullvad.mullvadvpn"
         minSdk = Versions.Android.minSdkVersion
@@ -114,7 +114,7 @@ android {
     sourceSets {
         getByName("main") {
             val changelogDir =
-                gradleLocalProperties(rootProject.projectDir)
+                gradleLocalProperties(rootProject.projectDir, providers)
                     .getOrDefault("OVERRIDE_CHANGELOG_DIR", defaultChangelogAssetsDirectory)
 
             assets.srcDirs(extraAssetsDirectory, changelogDir)
@@ -181,13 +181,13 @@ android {
 
     applicationVariants.configureEach {
         val alwaysShowChangelog =
-            gradleLocalProperties(rootProject.projectDir).getProperty("ALWAYS_SHOW_CHANGELOG")
+            gradleLocalProperties(rootProject.projectDir, providers).getProperty("ALWAYS_SHOW_CHANGELOG")
                 ?: "false"
 
         buildConfigField("boolean", "ALWAYS_SHOW_CHANGELOG", alwaysShowChangelog)
 
         val enableInAppVersionNotifications =
-            gradleLocalProperties(rootProject.projectDir)
+            gradleLocalProperties(rootProject.projectDir, providers)
                 .getProperty("ENABLE_IN_APP_VERSION_NOTIFICATIONS")
                 ?: "true"
 
@@ -304,13 +304,6 @@ afterEvaluate {
 
 play { serviceAccountCredentials.set(file("play-api-key.json")) }
 
-configurations.all {
-    resolutionStrategy {
-        // Hold back emoji2 since newer versions require api level 34 which is not yet stable.
-        force("androidx.emoji2:emoji2:1.3.0")
-    }
-}
-
 dependencies {
     implementation(project(Dependencies.Mullvad.vpnService))
     implementation(project(Dependencies.Mullvad.tileService))

android/buildSrc/src/main/kotlin/Versions.kt

@@ -1,17 +1,17 @@
 object Versions {
     const val commonsValidator = "1.8.0"
-    const val jodaTime = "2.12.5"
-    const val junit = "5.10.0"
+    const val jodaTime = "2.12.7"
+    const val junit = "5.10.2"
     const val jvmTarget = "17"
-    const val konsist = "0.13.0"
+    const val konsist = "0.14.0"
     const val kotlin = "1.9.22"
     const val kotlinCompilerExtensionVersion = "1.5.10"
-    const val kotlinx = "1.7.3"
-    const val leakCanary = "2.12"
-    const val mockk = "1.13.8"
+    const val kotlinx = "1.8.0"
+    const val leakCanary = "2.13"
+    const val mockk = "1.13.10"
     const val mockWebserver = "4.12.0"
     const val turbine = "1.0.0"
-    const val billingClient = "6.0.1"
+    const val billingClient = "6.2.0"
 
     object Android {
         const val compileSdkVersion = 34
@@ -26,7 +26,7 @@ object Versions {
         const val coreKtx = "1.12.0"
         const val espresso = "3.5.1"
         const val lifecycle = "2.7.0"
-        const val fragment = "1.6.1"
+        const val fragment = "1.6.2"
         const val test = "1.5.0"
         const val testMonitor = "1.6.1"
         const val testOrchestrator = "1.4.2"
@@ -35,25 +35,25 @@ object Versions {
     }
 
     object Compose {
-        const val destinations = "1.10.1"
-        const val base = "1.6.2"
+        const val destinations = "1.10.2"
+        const val base = "1.6.3"
         const val constrainLayout = "1.0.1"
         const val foundation = base
-        const val material3 = "1.2.0"
+        const val material3 = "1.2.1"
     }
 
     object Plugin {
         // The androidAapt plugin version must be in sync with the android plugin version.
         // Required for Gradle metadata verification to work properly, see:
         // https://github.com/gradle/gradle/issues/19228
-        const val android = "8.2.1"
-        const val androidAapt = "$android-10154469"
-        const val playPublisher = "3.8.4"
-        const val dependencyCheck = "8.3.1"
-        const val detekt = "1.23.4"
-        const val gradleVersions = "0.47.0"
+        const val android = "8.3.0"
+        const val androidAapt = "$android-10880808"
+        const val playPublisher = "3.9.0"
+        const val dependencyCheck = "9.0.9"
+        const val detekt = "1.23.5"
+        const val gradleVersions = "0.51.0"
         const val junit5 = "1.10.0.0"
-        const val ktfmt = "0.16.0"
+        const val ktfmt = "0.17.0"
         // Ksp version is linked with kotlin version, find matching release here:
         // https://github.com/google/ksp/releases
         const val ksp = "${kotlin}-1.0.17"

android/config/dependency-check-suppression.xml

@@ -60,4 +60,12 @@
         <packageUrl regex="true">^pkg:maven/com\.google\.devtools\.ksp/symbol\-processing.*@.*$</packageUrl>
         <cve>CVE-2018-1000840</cve>
     </suppress>
+    <suppress until="2024-09-01Z">
+        <notes><![CDATA[
+            False-positive related to Drupal rather than Android development.
+            https://nvd.nist.gov/vuln/detail/CVE-2014-9152
+        ]]></notes>
+        <packageUrl regex="true">^pkg:maven/androidx\.test\.services/storage@.*$</packageUrl>
+        <cve>CVE-2014-9152</cve>
+    </suppress>
 </suppressions>

android/gradle.properties

@@ -3,4 +3,3 @@ android.nonTransitiveRClass=false
 android.useAndroidX=true
 kotlin.code.style=official
 org.gradle.jvmargs=-Xmx8192M -Dkotlin.daemon.jvm.options\="-Xmx8192M"
-android.experimental.lint.version=8.3.0-beta02