[caleb-bit]

Overview

Upgrades the Android Gradle Plugin from 8.8.2 to 9.5.1, with only the changes AGP 9 requires. Most of the open Dependabot PRs fail because they need AGP 9. This PR is kept minimal so they can merge afterward.

Changes Made

• AGP 8.8.2 → 9.5.1, Gradle 8.10.2 → 9.9.1 (AGP 9 requires Gradle 9).
• Built-in Kotlin: removed the org.jetbrains.kotlin.android plugin, which AGP 9 replaces, and the unused root kotlin("jvm") plugin. Kotlin is 2.2.10, the lowest version AGP 9 accepts; Dependabot can bump it from here.
• kapt → KSP (2.3.13) for Hilt, since kapt doesn't work with built-in Kotlin.
• Hilt 2.51.1 → 2.60.1. 2.51.1 fails under AGP 9 with "Android BaseExtension not found".
• Apollo 4.0.0 → 4.4.4. 4.0.0 fails under AGP 9 with "KotlinSourceSet with name 'main' not found". The Apollo plugin and runtime now use the catalog version; before, they were hard-coded to 4.0.0 while the catalog said 4.1.1.
• jvmTarget moved from kotlinOptions to kotlin { compilerOptions { ... } }.
• Removed composeOptions.kotlinCompilerExtensionVersion, which Kotlin 2.x ignores.
• compileSdk 35 → 37. targetSdk stays at 35. AGP doesn't need this, but Dependabot never changes compileSdk and the androidx/coil bumps require 37.
• All plugin versions now live in libs.versions.toml.
• CodeQL: switched to advanced setup (.github/workflows/codeql.yml). Default setup's autobuild ran ./gradlew testClasses, which only compiled the empty root project (every task reported NO-SOURCE), so :app was never analyzed. That task no longer exists without the root kotlin("jvm") plugin. The new workflow writes google-services.json from the secret and builds assembleDebug plus the unit tests, so CodeQL analyzes the real app code. Default setup has been turned off in repo settings.

Test Coverage

• ./gradlew assembleDebug lint testDebugUnitTest passes locally on JDK 17.
• Not yet tested on a device. Hilt now uses KSP instead of kapt, so screens that use Hilt view models need a quick smoke test.

Next Steps

After this merges, comment @dependabot rebase on:

• Bump the kotlin group with 2 updates #130: Kotlin group (→ 2.4.21)
• Bump the androidx group with 7 updates #131: androidx group (needs compileSdk 37 from this PR)
• Bump io.coil-kt.coil3:coil-compose from 3.1.0 to 3.6.3 #134: coil-compose 3.6.3 (needs compileSdk 37 from this PR)

#132 (Hilt 2.60.1) is already covered here. #133 bumped the root kotlin("jvm") plugin, which this PR removes. Dependabot should close both on its own.

Related PRs or Issues

Unblocks #130, #131, #132, #133, #134.

🤖 Generated with Claude Code

[coderabbitai]

Important

• Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 2a96ce28-0198-4e91-b02b-d4ce0a0d0ce3

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[EmilJiang]

LGTM