fix(ci): unblock dependabot dependency bump (AGP 9.3.1, androidx.core 1.19.0, protobuf-javalite 4.35.1)

app/build.gradle.kts

@@ -36,7 +36,7 @@ val appVersionCode = appVersionName.split(".").let { (major, minor, patch) ->
 
 android {
     namespace = "dev.anchildress1.vestige"
-    compileSdk = 36
+    compileSdk = 37
 
     defaultConfig {
         applicationId = "dev.anchildress1.vestige"

app/proguard-rules.pro

@@ -10,4 +10,5 @@
 -dontwarn com.google.auto.value.AutoValue
 -dontwarn com.google.auto.value.AutoValue$Builder
 -dontwarn com.google.protobuf.Internal$ProtoNonnullApi
+-dontwarn com.google.protobuf.Internal$ProtoMethodMayReturnNull
 -dontwarn com.google.protobuf.ProtoPresenceBits

core-inference/build.gradle.kts

@@ -7,7 +7,7 @@ plugins {
 
 android {
     namespace = "dev.anchildress1.vestige.inference"
-    compileSdk = 36
+    compileSdk = 37
 
     defaultConfig {
         minSdk = 31
@@ -28,6 +28,9 @@ android {
     }
 
     testOptions {
+        // Pinned below compileSdk: Robolectric 4.16.1 tops out at SDK 36 (SDK 37 support ships
+        // in 4.17-beta-1). Test manifests otherwise default targetSdkVersion to compileSdk.
+        targetSdk = 36
         unitTests {
             isIncludeAndroidResources = true
             isReturnDefaultValues = true

core-storage/build.gradle.kts

@@ -9,7 +9,7 @@ plugins {
 
 android {
     namespace = "dev.anchildress1.vestige.storage"
-    compileSdk = 36
+    compileSdk = 37
 
     defaultConfig {
         minSdk = 31
@@ -30,6 +30,9 @@ android {
     }
 
     testOptions {
+        // Pinned below compileSdk: Robolectric 4.16.1 tops out at SDK 36 (SDK 37 support ships
+        // in 4.17-beta-1). Test manifests otherwise default targetSdkVersion to compileSdk.
+        targetSdk = 36
         unitTests {
             isIncludeAndroidResources = true
             isReturnDefaultValues = true

gradle/libs.versions.toml

@@ -1,12 +1,12 @@
 [versions]
 # Build tooling
-agp = "9.2.1"
-kotlin = "2.3.21"
-gradle = "9.5.1"
+agp = "9.3.1"
+kotlin = "2.4.10"
+gradle = "9.7.0"
 
 # AndroidX core
 androidx-annotation = "1.10.0"
-androidx-core-ktx = "1.18.0"
+androidx-core-ktx = "1.19.0"
 androidx-activity-compose = "1.13.0"
 androidx-lifecycle = "2.10.0"
 
@@ -29,30 +29,30 @@ litert-lm = "0.11.0"
 localagents-rag = "0.3.0"
 # Runtime dep of localagents-rag's GemmaEmbeddingModel — pulled directly because the SDK's
 # only protobuf provider sits behind its optional `tasks-genai` dependency.
-protobuf-javalite = "4.34.1"
+protobuf-javalite = "4.35.1"
 
 # Quality
-kover = "0.9.8"
+kover = "0.9.9"
 ktlint-cli = "1.8.0"
-sonar = "7.3.0.8198"
+sonar = "7.4.0.8496"
 
 # Collections
-kotlinx-collections-immutable = "0.3.7"
+kotlinx-collections-immutable = "0.5.1"
 
 # Coroutines
 kotlinx-coroutines = "1.11.0"
 
 # Testing
 junit = "4.13.2"
-junit-jupiter = "6.0.3"
-junit-platform = "6.0.3"
-mockk = "1.14.9"
+junit-jupiter = "6.1.3"
+junit-platform = "6.1.3"
+mockk = "1.14.11"
 turbine = "1.2.1"
 # Android's android.jar ships org.json at runtime, but the AGP mockable jar stubs every method.
 # Pin the upstream artifact for unit tests so JSON-driven parsers (LensResponseParser) exercise
 # the real implementation. Same package coordinates as Android's built-in — production code
 # stays on the platform implementation.
-json = "20251224"
+json = "20260719"
 androidx-test-core = "1.7.0"
 androidx-test-ext-junit = "1.3.0"
 androidx-test-espresso = "3.7.0"

gradle/wrapper/gradle-wrapper.properties

@@ -1,6 +1,6 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-9.5.1-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.7.0-bin.zip
 networkTimeout=10000
 retries=0
 retryBackOffMs=500