chore(deps): bump gradle 9.7.0 / compose / appcompat / KSP + fix gitleaks - #77
Merged
Conversation
- Kotlin 2.3.21 -> 2.4.20-RC (fixes CVE-2026-53914 unsafe deserialization in build cache; only pre-release toolchain carries the patch) - KSP 2.3.10 -> 2.3.11, compose-bom 2026.06.01 -> 2026.08.00, appcompat 1.7.1 -> 1.8.0, gradle wrapper 9.6.1 -> 9.7.0 - Replace gitleaks/gitleaks-action@v2 (requires paid org license) with the pinned MIT gitleaks CLI so the secrets scan passes on org-owned repos
The gitleaks CLI (unlike the previously-broken licensed action) actually runs and flagged FORMAT_XCHACHA_KEY = "xchacha20poly1305_key" as a generic-api-key false positive. Add a .gitleaks.toml allowlist for that algorithm identifier and pass it explicitly to the scan.
CodeQL's build-tracer extractor rejects Kotlin 2.4.20-RC (KotlinVersionTooRecentError: supports versions below 2.4.20). Buildless source extraction avoids compiling under the tracer, so analysis no longer depends on the extractor keeping pace with the compiler version.
CVE-2026-53914's only patched Kotlin (>= 2.4.20-Beta1) is rejected by CodeQL's extractor (supports < 2.4.20), and buildless mode extracts no Kotlin sources either. The two requirements are mutually exclusive right now, so roll Kotlin back to 2.3.21 and restore the build-based CodeQL analysis. The build-cache deserialization alert is tracked separately and does not affect the shipped artifact. Revisit when a stable Kotlin 2.4.20 lands with CodeQL support. Retains: gradle 9.7.0, compose-bom 2026.08.00, appcompat 1.8.0, KSP 2.3.11, and the license-free gitleaks scan.
r0073rr0r
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves the two open items.
Supersedes #76 (dependency group bump)
Applies the same bumps directly:
The only failing check on #76 was
gitleaks, which fails on every org PR becausegitleaks/gitleaks-action@v2now requires a paid org license — unrelated to the PR content. Fixed here.Gitleaks (license-free)
.gitleaks.tomlallowlisting the non-secretxchacha20poly1305_keyformat-label constant that tripped the generic-api-key rule.Dependabot #49 (CVE-2026-53914, Kotlin build-cache) — handled separately
The only patched Kotlin (≥ 2.4.20-Beta1) is not yet supported by CodeQL's extractor (supports < 2.4.20), so upgrading breaks the CodeQL security scan. The two are mutually exclusive right now. Kotlin stays at 2.3.21 and the alert is dismissed as tolerable risk: it is a build-cache-only deserialization issue that does not affect the shipped APK/AAB. To be revisited once a stable Kotlin 2.4.20 ships with CodeQL support.
Verification (local)
./gradlew clean assembleDebug— SUCCESS, zerow:/deprecation warnings./gradlew testDebugUnitTest— SUCCESS