chore(deps): the Android tier, and the Kotlin version this build does not own - #469
Conversation
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: Warning Your free Security trial is over. An organization admin can activate billing to continue. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Antigravity review (Gemini via Ultra)This PR updates the Android Gradle Plugin, Compose ecosystem, and several other dependencies, adding extensive commentary on how AGP and the Compose compiler plugin interact. Blocking issuesNone found. Suggestions
Nitpicks
Automated first-pass review by Earlier review rounds (newest first)Round reviewed at 2026-08-25 05:09 UTCAntigravity review (Gemini via Ultra)This PR updates various Android dependencies, including Android Gradle Plugin to 9.3.2, the Compose BOM to 2026.08.00, and the Compose compiler plugin to 2.3.21. Blocking issuesNone found. Suggestions
Nitpicks
Automated first-pass review by Earlier review rounds (newest first)Round reviewed at 2026-08-25 04:55 UTCAntigravity review (Gemini via Ultra)This PR updates the Android Gradle Plugin, Compose BOM, Compose compiler, and several other Android dependencies, including a major version bump to Play Services Games v2. Blocking issues
Suggestions
Nitpicks
Automated first-pass review by |
Replying to the Antigravity reviewBoth blocking issues are declined, refuted by the same measurement — and the measurement is the one this PR's own description said would be the arbiter. 1. "Compose compiler plugin 2.3.21 against AGP-bundled Kotlin 2.2.10 will break the build." The premise about Kotlin is correct: since 2.0 the Compose compiler ships in the Kotlin repository and its plugin version must match the Kotlin compiler. The reading of that That coordinate is
Recorded in 2. " Same evidence, and it is specific: the job builds the What that does not prove is runtime behaviour against live Play Games services, which no CI here can reach. Stated rather than implied. On the two suggestions:
Worth noting the finding did its job even though it was wrong: it named a specific, checkable failure mode, and checking it is what turned "these versions are probably fine" into a build log. |
… not own
Takes the Android dependency set to current, and settles a question the last
refresh deferred on purpose.
* AGP 9.2.1 -> 9.3.2, both `com.android.application` and `com.android.test`
* Compose compiler plugin 2.3.10 -> 2.3.21
* androidx.baselineprofile 1.5.0-alpha06 -> 1.5.0-rc01, and the matching
benchmark-macro-junit4 in :baselineprofile
* compose-bom 2026.06.00 -> 2026.08.00
* material3.adaptive, adaptive-layout and adaptive-navigation 1.2.0 -> 1.3.0
* net.java.dev.jna 5.18.1 -> 5.19.1
* play-services-games-v2 21.0.0 -> 22.0.0
The previous refresh added the `gradle` Dependabot ecosystem specifically
because this set could NOT be hand-bumped safely -- an interlocked group, each
pin carrying a written reason, none verifiable without an Android SDK and NDK.
Its first run opened five PRs.
Two of the bumps here are NOT among those five. The Compose compiler plugin and
`baselineprofile` are absent because `open-pull-requests-limit` is 5 and all
five slots were taken, not because Dependabot judged them incompatible. A
saturated limit looks exactly like "nothing else to update", which is why it is
written down here rather than left to be inferred from an empty queue.
AGP 9.2.1 and 9.3.2 declare the SAME `kotlin-gradle-plugin` coordinate (2.2.10)
in their published POMs, so crossing that minor does not move the Kotlin
requirement. Fetched from dl.google.com, not recalled.
Asked directly: can `kotlin-gradle-plugin` be taken to 2.2.10+?
It cannot, and the reason is a decision already recorded in this file. AGP 9
ships built-in Kotlin -- it bundles the Kotlin Gradle plugin -- so the standalone
`org.jetbrains.kotlin.android` plugin was deliberately dropped from the root
script and from :app. THERE IS NO `kotlin-gradle-plugin` VERSION IN THIS BUILD
TO SET. AGP owns it, and to move Kotlin you move AGP.
The obvious next move -- re-adding `org.jetbrains.kotlin.android` with an
explicit version -- would reintroduce exactly the standalone plugin AGP 9
replaces, and two things applying Kotlin at once is the failure the drop
avoided.
One further distinction is recorded so it is not re-derived from the same POM:
that 2.2.10 coordinate is AGP's OWN runtime dependency, not the Kotlin the build
compiles user code with. The evidence is in the tree already -- AGP 9.2.1 has
been pairing with a 2.3.x Compose compiler plugin and building. The Compose
compiler plugin is the only Kotlin coordinate this build controls, and it moves
here.
`androidx.baselineprofile` moves within the SAME 1.5.0 line. The written reason
for pinning that line -- 1.4.x's module-type guard rejects an AGP-9 application
module, and 1.5.0 is the first to widen the supported-AGP window -- is unchanged;
this is the same window with fewer unknowns, not a new dependency decision.
Cargo, GitHub Actions and the pre-commit hooks were re-checked at the same time
and are all already current from the previous refresh: `cargo update` proposes
nothing, and every pinned action equals its newest release. Stated because "we
also checked and there was nothing" is a different claim from "we did not look".
`android.yml` runs on this PR because it triggers on `android/**`, and it is the
only thing that can validate these -- there is no Android SDK or NDK here. It is
also NOT a required check, so a red job blocks nothing: the job result is read
before this is called green rather than inferred from the merge button.
…ing it Review raised, as a blocking issue, that the Compose compiler plugin must equal the Kotlin compiler version and that 2.3.21 against AGP's POM-declared 2.2.10 would break the build. The premise about Kotlin is right; the reading of that POM entry is not. Settled by measurement rather than argument: the release bundle job builds both flavours with AGP 9.3.2 and the plugin at 2.3.21 and reports BUILD SUCCESSFUL in 17m20s, Compose compilation and R8 included. The comment now records that instead of reasoning toward it.
bf07a6c to
34a3a42
Compare
Takes the Android dependency set to current, and settles a question the previous
refresh deferred on purpose.
Supersedes all five open Dependabot PRs — #463 (
jna), #464(
compose-bom), #465 (adaptive-layout), #466(
play-services-games-v2), #467 (AGP).What moves
com.android.application/com.android.testandroidx.baselineprofile+benchmark-macro-junit4androidx.compose:compose-bommaterial3.adaptive×3net.java.dev.jnaplay-services-games-v2The mechanism working as designed
The
gradleecosystem was added in #462 specifically because this set couldnot be hand-bumped safely — an interlocked group, each pin carrying a written
reason, none verifiable without an Android SDK and NDK. Its first run opened
five PRs.
Two of the bumps here are not among those five. The Compose compiler plugin
and
baselineprofileare absent becauseopen-pull-requests-limitis 5 and allfive slots were taken — not because Dependabot judged them incompatible. A
saturated limit looks exactly like "nothing else to update", which is why it is
written down rather than inferred from an empty queue.
The interlock, measured
AGP 9.2.1 and 9.3.2 declare the same
kotlin-gradle-plugincoordinate(2.2.10) in their published POMs, so crossing that minor does not move the
Kotlin requirement. Fetched from
dl.google.com, not recalled.The Kotlin version this build does not own
Asked directly during review: can
kotlin-gradle-pluginbe taken to 2.2.10+?It cannot, and the reason is a decision already recorded in the build script.
AGP 9 ships built-in Kotlin — it bundles the Kotlin Gradle plugin — so the
standalone
org.jetbrains.kotlin.androidplugin was deliberately dropped fromthe root script and from
:app. There is nokotlin-gradle-pluginversion inthis build to set. AGP owns it; to move Kotlin, move AGP.
Re-adding
org.jetbrains.kotlin.androidwith an explicit version wouldreintroduce exactly the standalone plugin AGP 9 replaces, and two things
applying Kotlin at once is the failure that drop avoided.
One further distinction is recorded so nobody re-derives the wrong conclusion
from the same POM: that 2.2.10 is AGP's own runtime dependency, not the
Kotlin the build compiles user code with. The evidence is already in the tree —
AGP 9.2.1 has been pairing with a 2.3.x Compose compiler plugin and building
green. The Compose compiler plugin is the only Kotlin coordinate this build
controls, and it moves here.
alpha → rc
androidx.baselineprofilemoves within the same 1.5.0 line. Its writtenreason for existing — 1.4.x's module-type guard rejects an AGP-9 application
module, and 1.5.0 is the first to widen the supported-AGP window — is unchanged.
Same window, fewer unknowns; not a new dependency decision.
Scope, and why it is only Android
Cargo, GitHub Actions and the pre-commit hooks were re-checked at the same time
and are all already current from #462:
cargo updateproposes nothing, andevery pinned action equals its newest release. Stated because "we checked and
there was nothing" is a different claim from "we did not look".
Verification
android.ymlruns on this PR (it triggers onandroid/**) and is the onlything that can validate these — there is no Android SDK or NDK on this machine.
It is also not a required check, so a red job blocks nothing: the job result
will be read before this is called green, rather than inferred from the merge
button being available.
No Rust changes, so AccuracyCoin and nestest are untouched by construction.