build: update dependencies to latest versions (#2387)

* build: update dependencies to latest versions

Bumps the version catalog and a handful of hardcoded snippet
dependencies to their latest releases, including major upgrades:
AGP 8.13.2 -> 9.3.1, Gradle 9.1.0 -> 9.7.0, Kotlin 2.2.0 -> 2.4.10,
KSP 2.2.20-2.0.4 -> 2.3.11 (now versioned independently of Kotlin),
Maps Compose 7.0.0/6.12.0 -> 8.4.0, Places(-ktx) and
android-maps-utils to their latest majors. Also aligns app-rx's
hardcoded play-services-maps/places versions with the rest of the
repo.

* build: bump actions/checkout to v7 and actions/setup-python to v7

Both are new majors since the last actions bump (#2377). Verified no
workflow uses pull_request_target/workflow_run (affected by
checkout v7's fork-checkout change) or setup-python's removed
pip-install input, so no other changes are needed.

* docs: sync WearOS install-snippet version comment with catalog

scripts/update_docs_versions.py enforces this in CI; the wear bump
to 1.4.0 left the inline comment stale.

* build: regenerate Gradle wrapper for 9.7.0 via official wrapper task

Ran ./gradlew wrapper --gradle-version=9.7.0 instead of hand-editing
gradle-wrapper.properties, since that also refreshes
gradle-wrapper.jar and the gradlew/gradlew.bat scripts (and picks up
new 9.x wrapper properties like retries/retryBackOffMs). Drops the
distributionSha256Sum pin as requested.

* build: migrate to AGP 9 built-in Kotlin support

AGP 9 provides Kotlin support natively and refuses to configure a
module that still applies org.jetbrains.kotlin.android alongside it.
Removes that plugin (all its declaration styles: catalog alias,
kotlin("android"), and hardcoded id(...)) from every module actually
wired into settings.gradle.kts, and drops the now-unused kotlin-android
catalog entry.

Also fixes two things AGP 9 surfaced as hard errors during
configuration, unrelated to the plugin removal itself:
- ApiDemos:java-app had a vestigial buildFeatures.compose = true with
  no Kotlin sources or Compose dependencies; AGP 9 now requires the
  Compose Compiler plugin whenever compose is enabled, so the dead
  flag is removed instead.
- tutorials/kotlin/Polygons used the now-unsupported
  proguard-android.txt default file, replaced with
  proguard-android-optimize.txt.

Standalone tutorial/sample directories not wired into
settings.gradle.kts (app-rx, the java/ and duplicate kotlin/ tutorial
folders) are untouched since they aren't part of the actual build
graph or CI.

* build: bump compileSdk/targetSdk to 37

androidx.core:core-ktx 1.19.0 requires compiling against API 37+;
CI's checkDebugAarMetadata caught this. Also switches
app-utils-ktx off its hardcoded compileSdk/targetSdk = 36 onto the
catalog value, matching every other module.

* build: pin GitHub Actions to commit SHAs

The org's zizmor policy check (triggered whenever workflow files
change) requires every `uses:` reference to be pinned to a full
commit SHA rather than a floating version tag. Touching these three
files for the checkout/setup-python bump made the check actually
run for the first time in a while and it flagged all 36 `uses:`
lines in them (not just the ones changed), so pins every action
reference across build.yml, lint.yml, and generate-v3.yml, each with
a version comment. release-please.yml is untouched by this PR and
wasn't flagged, so left as-is.

* build: add explicit workflow permissions and disable credential persistence

zizmor flagged two more findings once these files started being
scanned: excessive-permissions (Medium, blocking) because none of
the three workflows declared an explicit permissions: block and so
ran with the default broad GITHUB_TOKEN scope, and artipacked (Low,
informational) because checkout steps left credentials persisted in
the git config, which get exposed to anything that later reads the
workspace (e.g. artifact uploads).

- build.yml: contents: read (checkout + build only, no writes)
- lint.yml: contents: read, security-events: write (needed for
  github/codeql-action/upload-sarif)
- generate-v3.yml: contents: read (the actual PR push uses its own
  SYNCED_GITHUB_TOKEN_REPO secret via peter-evans/create-pull-request,
  not the default token)
- persist-credentials: false added to every actions/checkout step
  across all three files; none of them do a subsequent git push with
  the default token, so this is safe.

* fix: findViewById<View> instead of View? for applyInsets calls

applyInsets(container: View) takes a non-null View, but every
kotlin-app activity called it as
applyInsets(findViewById<View?>(R.id.map_container)). Kotlin's
newer compiler no longer treats an explicit nullable type argument
on a platform-typed Java generic method leniently, so this now hard
fails to compile instead of silently working. All 24 call sites
always assumed a non-null result anyway (no null check), so this
just drops the incorrect nullable type argument.

* fix: adapt app-utils-ktx snippets to android-maps-utils 5.1.1 API

The android-maps-utils bump (3.19.0 -> 5.1.1, part of the dependency
update) rewrote the library in Kotlin, which is a source-incompatible
change for these snippets:

- ClusterItem is now a Kotlin interface with val properties
  (position, title, snippet, zIndex: Float?), not Java-style getter
  methods. Clustering.kt and Multilayer.kt's MyItem implementations
  used `override fun getPosition()` etc., which no longer overrides
  anything Kotlin recognizes; converted to `override val` properties
  matching the new interface, constructor-promoted where possible.
- KmlLayer/KmlContainer expose getContainers()/getPlacemarks() as
  plain functions, not Kotlin properties, and KmlContainer's backing
  fields are now private. Feature.getId() is likewise a function.
  KML.kt used property-access syntax (layer.containers, feature.id)
  for all of these; switched to explicit method calls.
- GeoJsonLayer's default style accessor is getDefaultPointStyle(),
  not a defaultPointStyle property; fixed in GeoJSON.kt.
- KmlLayer/GeoJsonLayer constructors now take non-null
  Context/InputStream/JSONObject instead of the old nullable
  platform types. These snippet files use throwaway `= null`
  placeholders for doc purposes (never actually run), so added `!!`
  at each call site to match, consistent with the existing `map!!`
  pattern already used nearby.

Verified each API shape against the actual v5.1.1 source on
googlemaps/android-maps-utils (the library moved to a Kotlin
rewrite there) rather than guessing.

* fix: remaining android-maps-utils 5.1.1 API breaks

Two more spots the compiler hadn't reached yet in the previous fix pass:

- GeoJsonPointStyle (Kotlin, android-maps-utils 5.1.1) exposes
  isDraggable()/setDraggable(), getTitle()/setTitle(),
  getSnippet()/setSnippet() as plain functions, not var properties,
  so app-utils-ktx/GeoJSON.kt's `pointStyle.isDraggable = true` style
  assignments don't compile; switched to explicit setter calls.
- KmlContainer.getProperty() now returns String? (nullable); KML.kt
  passed it straight to Log.i's non-null second parameter, added !!
  (guarded by the existing hasProperty() check just above it).
- The JSONObject-argument GeoJsonLayer constructor is now annotated
  @throws(JSONException::class) in Kotlin, which surfaces in Java as
  a checked exception. snippets/app-utils (Java)'s
  addGeoJsonLayerJsonObject() didn't declare it; added `throws
  JSONException` to match its sibling method's existing pattern.

* fix: remember MarkerState in FireMarkers to satisfy lint

AGP 9's bundled lint now flags UnrememberedMutableState as an error
(previously warning/unreported): MarkerState(...) was created fresh
every recomposition, which would also reset marker drag state.
Wraps it in remember(markerData.id) so each marker's state survives
recomposition and is invalidated by React iOnly when the marker's
identity actually changes.

* refactor(snippets): use version catalog in documentation snippets and update Places SDK

- Update dependencies in snippets (app-compose, app-utils, app-places-ktx)
  to use the Gradle version catalog (libs.*), resolving UseTomlInstead lint
  findings flagged by code scanning.
- Add documentation comments within region tags showing both the recommended
  version catalog configuration (TOML block) and the standalone coordinate
  declaration for non-catalog projects.
- Replace deprecated places-ktx dependency with core Places SDK (libs.places),
  as Kotlin extensions and coroutines are built directly into the Places SDK.
- Add mapsUtils to gradle/libs.versions.toml.
- Add missing androidTest dependencies (ext.junit, espresso.idling.resource)
  to ApiDemos:kotlin-app and update LatLngSubject / LatLngBoundsSubject custom
  Truth subject factories for Kotlin 2.4 / Truth 1.4.5 compatibility.
- Add .kotlin/ compiler directory to .gitignore.

---------

Co-authored-by: Dale Hawkins <107309+dkhawk@users.noreply.github.com>

Author: kikoso

.github/workflows/build.yml

@@ -25,23 +25,28 @@ on:
     types: [ build ]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
 jobs:
   build-ApiDemos:
     runs-on: ubuntu-latest
     timeout-minutes: 45
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
 
     - name: set up Java 21
-      uses: actions/setup-java@v5
+      uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
       with:
         distribution: 'temurin'
         java-version: '21'
 
     - name: Setup Gradle
-      uses: gradle/actions/setup-gradle@v6
+      uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
 
     - name: Build and check
       run: |
@@ -55,16 +60,18 @@ jobs:
     timeout-minutes: 45
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
 
     - name: set up Java 21
-      uses: actions/setup-java@v5
+      uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
       with:
         distribution: 'temurin'
         java-version: '21'
 
     - name: Setup Gradle
-      uses: gradle/actions/setup-gradle@v6
+      uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
 
     - name: Build and check
       run: ./gradlew :WearOS:Wearable:assembleDebug
@@ -74,16 +81,18 @@ jobs:
     timeout-minutes: 45
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
 
     - name: set up Java 21
-      uses: actions/setup-java@v5
+      uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
       with:
         distribution: 'temurin'
         java-version: '21'
 
     - name: Setup Gradle
-      uses: gradle/actions/setup-gradle@v6
+      uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
 
     - name: Build and check
       run: ./gradlew :FireMarkers:app:assembleDebug
@@ -93,16 +102,18 @@ jobs:
     timeout-minutes: 45
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
 
     - name: set up Java 21
-      uses: actions/setup-java@v5
+      uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
       with:
         distribution: 'temurin'
         java-version: '21'
 
     - name: Setup Gradle
-      uses: gradle/actions/setup-gradle@v6
+      uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
 
     - name: Build and check
       run: |
@@ -118,16 +129,18 @@ jobs:
     timeout-minutes: 45
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
 
     - name: set up Java 21
-      uses: actions/setup-java@v5
+      uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
       with:
         distribution: 'temurin'
         java-version: '21'
 
     - name: Setup Gradle
-      uses: gradle/actions/setup-gradle@v6
+      uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
 
     - name: Build and check
       run: |
@@ -143,9 +156,11 @@ jobs:
       - build-Snippets
       - build-tutorials
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: set up Java 21
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           distribution: 'temurin'
           java-version: '21'

.github/workflows/generate-v3.yml

@@ -19,22 +19,27 @@ on:
   repository_dispatch:
     types: [ generate-v3 ]
 
+permissions:
+  contents: read
+
 jobs:
   generate-v3:
     runs-on: ubuntu-latest
     timeout-minutes: 45
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
 
     - name: set up JDK 17
-      uses: actions/setup-java@v5
+      uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
       with:
         distribution: 'temurin'
         java-version: 17
 
     - name: Setup Gradle
-      uses: gradle/actions/setup-gradle@v6
+      uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
 
     - name: Install NDK
       run: |
@@ -48,7 +53,7 @@ jobs:
         echo "files-changed=$(git status -s | wc -l)" >> $GITHUB_OUTPUT
 
     - name: PR Changes
-      uses: peter-evans/create-pull-request@v8
+      uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
       if: steps.gradlew-generate-v3.outputs.files-changed > 0
       with:
         token: ${{ secrets.SYNCED_GITHUB_TOKEN_REPO }}

.github/workflows/lint.yml

@@ -19,30 +19,36 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+  security-events: write
+
 jobs:
   lint:
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           distribution: 'temurin'
           java-version: '21'
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.x'
 
       - name: Check documentation versions
         run: python3 scripts/update_docs_versions.py --check
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v6
+        uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
 
       - name: Run Android Lint
         run: |
@@ -59,67 +65,67 @@ jobs:
           ./gradlew :FireMarkers:app:lintDebug
 
       - name: Upload SARIF for ApiDemos:kotlin-app
-        uses: github/codeql-action/upload-sarif@v4
+        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
         with:
           sarif_file: ApiDemos/project/kotlin-app/build/reports/lint-results-debug.sarif
           category: ApiDemos-kotlin-app
 
       - name: Upload SARIF for ApiDemos:java-app
-        uses: github/codeql-action/upload-sarif@v4
+        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
         with:
           sarif_file: ApiDemos/project/java-app/build/reports/lint-results-debug.sarif
           category: ApiDemos-java-app
 
       - name: Upload SARIF for ApiDemos:common-ui
-        uses: github/codeql-action/upload-sarif@v4
+        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
         with:
           sarif_file: ApiDemos/project/common-ui/build/reports/lint-results-debug.sarif
           category: ApiDemos-common-ui
 
       - name: Upload SARIF for snippets:app
-        uses: github/codeql-action/upload-sarif@v4
+        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
         with:
           sarif_file: snippets/app/build/reports/lint-results-debug.sarif
           category: snippets-app
 
       - name: Upload SARIF for snippets:app-utils
-        uses: github/codeql-action/upload-sarif@v4
+        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
         with:
           sarif_file: snippets/app-utils/build/reports/lint-results-debug.sarif
           category: snippets-app-utils
 
       - name: Upload SARIF for snippets:app-utils-ktx
-        uses: github/codeql-action/upload-sarif@v4
+        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
         with:
           sarif_file: snippets/app-utils-ktx/build/reports/lint-results-debug.sarif
           category: snippets-app-utils-ktx
 
       - name: Upload SARIF for snippets:app-places-ktx
-        uses: github/codeql-action/upload-sarif@v4
+        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
         with:
           sarif_file: snippets/app-places-ktx/build/reports/lint-results-debug.sarif
           category: snippets-app-places-ktx
 
       - name: Upload SARIF for snippets:app-ktx
-        uses: github/codeql-action/upload-sarif@v4
+        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
         with:
           sarif_file: snippets/app-ktx/build/reports/lint-results-debug.sarif
           category: snippets-app-ktx
 
       - name: Upload SARIF for snippets:app-compose
-        uses: github/codeql-action/upload-sarif@v4
+        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
         with:
           sarif_file: snippets/app-compose/build/reports/lint-results-debug.sarif
           category: snippets-app-compose
 
       - name: Upload SARIF for WearOS:Wearable
-        uses: github/codeql-action/upload-sarif@v4
+        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
         with:
           sarif_file: WearOS/Wearable/build/reports/lint-results-debug.sarif
           category: WearOS-Wearable
 
       - name: Upload SARIF for FireMarkers:app
-        uses: github/codeql-action/upload-sarif@v4
+        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
         with:
           sarif_file: FireMarkers/app/build/reports/lint-results-debug.sarif
           category: FireMarkers-app

.gitignore

@@ -9,4 +9,5 @@ secrets.properties
 
 # This covers new IDEs, like Antigravity
 .vscode/
-**/bin/
+**/bin/
+.kotlin/

ApiDemos/project/common-ui/build.gradle.kts

@@ -18,7 +18,6 @@ import org.jetbrains.kotlin.gradle.dsl.JvmTarget
 
 plugins {
     alias(libs.plugins.android.library)
-    alias(libs.plugins.kotlin.android)
 }
 
 android {

ApiDemos/project/java-app/build.gradle.kts

@@ -34,7 +34,6 @@ android {
     }
 
     buildFeatures {
-        compose = true
         buildConfig = true
         viewBinding = true
     }

ApiDemos/project/kotlin-app/build.gradle.kts

@@ -18,7 +18,6 @@ import org.jetbrains.kotlin.gradle.dsl.JvmTarget
 
 plugins {
     alias(libs.plugins.android.application)
-    alias(libs.plugins.kotlin.android)
     alias(libs.plugins.kotlin.parcelize)
     alias(libs.plugins.secrets.gradle.plugin)
 }
@@ -94,6 +93,8 @@ dependencies {
 
     // Tests
     testImplementation(libs.junit)
+    androidTestImplementation(libs.ext.junit)
+    androidTestImplementation(libs.espresso.idling.resource)
     androidTestImplementation(libs.junit)
     androidTestImplementation(libs.espresso.core)
     androidTestImplementation(libs.truth)

ApiDemos/project/kotlin-app/src/androidTest/java/com/example/kotlindemos/truth/LatLngBoundsSubject.kt

@@ -26,14 +26,18 @@ import com.google.common.truth.Truth
  */
 class LatLngBoundsSubject private constructor(
     failureMetadata: FailureMetadata,
-    private val actual: LatLngBounds
+    private val actual: LatLngBounds?
 ) : Subject(failureMetadata, actual) {
 
     /**
      * Asserts that the given [LatLng] is contained within the actual bounds, allowing for
      * a small tolerance to account for floating-point inaccuracies.
      */
     fun containsWithTolerance(expected: LatLng) {
+        if (actual == null) {
+            failWithActual("expected to contain", expected)
+            return
+        }
         val tolerance = 1e-5
         val contains = actual.southwest.latitude - tolerance <= expected.latitude &&
             expected.latitude <= actual.northeast.latitude + tolerance &&
@@ -60,11 +64,13 @@ class LatLngBoundsSubject private constructor(
     }
 
     companion object {
+        fun latLngBounds(): Factory<LatLngBoundsSubject, LatLngBounds> = Factory(::LatLngBoundsSubject)
+
         /**
          * Creates a [LatLngBoundsSubject] for asserting on the given [LatLngBounds].
          */
-        fun assertThat(actual: LatLngBounds): LatLngBoundsSubject {
-            return Truth.assertAbout(::LatLngBoundsSubject).that(actual)
+        fun assertThat(actual: LatLngBounds?): LatLngBoundsSubject {
+            return Truth.assertAbout(latLngBounds()).that(actual)
         }
     }
 }