Upgrade Android SDK used in common lib to Android 17, targets AB#3689049, Fixes AB#3689049

LabApiUtilities/build.gradle

@@ -1,13 +1,13 @@
 plugins {
     id 'java-library'
     id 'maven-publish'
-    id 'com.microsoft.identity.buildsystem' version '0.2.5'
+    id 'com.microsoft.identity.buildsystem' version '0.2.6'
 
     // the below build plugin allows to generate BuildConfig files in a JAVA gradle project.
     // BuildConfig files are generated by default in an Android project, however, a non-Android java
     // module doesn't really have a concept of BuildConfig. This plugin allows us to create similar
     // looking BuildConfig constants in a java project.
-    id 'com.github.gmazzo.buildconfig' version '3.0.0'
+    id 'com.github.gmazzo.buildconfig' version '6.0.10'
 
     // Test retries
     id 'org.gradle.test-retry' version '1.5.6'
@@ -56,12 +56,16 @@ buildConfig {
 
 sourceSets {
     main {
-        buildConfigField("String", "LAB_CLIENT_SECRET", "\"$labClientSecret\"")
-        java.srcDirs = ['src/main', "$project.buildDir/generated/source/buildConfig/main"]
+        buildConfig {
+            buildConfigField("String", "LAB_CLIENT_SECRET", "\"$labClientSecret\"")
+        }
+        java.srcDirs = ['src/main', "$project.buildDir/generated/sources/buildConfig/main"]
     }
     test {
-        java.srcDirs = ['src/test', "$project.buildDir/generated/source/buildConfig/test"]
-        buildConfigField("String", "LAB_CLIENT_SECRET", "\"$labClientSecret\"")
+        java.srcDirs = ['src/test', "$project.buildDir/generated/sources/buildConfig/test"]
+        buildConfig {
+            buildConfigField("String", "LAB_CLIENT_SECRET", "\"$labClientSecret\"")
+        }
     }
 }
 
@@ -92,7 +96,7 @@ dependencies {
 afterEvaluate {
     // these tasks are generated by the buildconfig plugin..for more details, read comment about it
     // above in the plugins block.
-    compileJava.dependsOn generateBuildConfig, generateTestBuildConfig
+    compileJava.dependsOn 'generateBuildConfigClasses', 'generateTestBuildConfigClasses'
 }
 
 jar {
@@ -130,6 +134,3 @@ publishing {
         }
     }
 }
-
-sourceCompatibility = "1.8"
-targetCompatibility = "1.8"

azure-pipelines/pull-request-validation/build-consumers.yml

@@ -123,15 +123,15 @@ stages:
       displayName: Assemble msal
       inputs:
         jdkArchitecture: x64
-        jdkVersionOption: "1.17"
+        jdkVersionOption: "1.21"
         tasks: clean msal:assembleLocal
     - template: ../templates/steps/automation-cert.yml
     - task: Gradle@3
       displayName: Run msal Unit tests
       inputs:
         tasks: msal:testLocalDebugUnitTest -Plabtest -PlabSecret=$(LabVaultAppCert) -ProbolectricSdkVersion=${{variables.robolectricSdkVersion}} -PmockApiUrl=$(MOCK_API_URL) -PnativeAuthConfigString=$(NATIVE_AUTH_CONFIG_STRING)
         jdkArchitecture: x64
-        jdkVersionOption: "1.17"
+        jdkVersionOption: "1.21"
   # msalautomationapp
   - job: msalAutomationAppValidation
     displayName: MSAL Automation App
@@ -161,7 +161,7 @@ stages:
       displayName: Assemble msalautomationapp
       inputs:
         jdkArchitecture: x64
-        jdkVersionOption: "1.17"
+        jdkVersionOption: "1.21"
         tasks: clean msalautomationapp:assembleLocal
   # broker
   - job: brokerValidation
@@ -204,10 +204,10 @@ stages:
         tasks: AADAuthenticator:clean AADAuthenticator:assembleLocal --build-cache --info
         publishJUnitResults: false
         jdkArchitecture: x64
-        jdkVersionOption: "1.17"
+        jdkVersionOption: "1.21"
     - task: Gradle@3
       displayName: Run broker Unit tests
       inputs:
         tasks: AADAuthenticator:localDebugAADAuthenticatorUnitTestCoverageReport --build-cache --info -Plabtest -PlabSecret=$(LabVaultAppCert) -ProbolectricSdkVersion=${{variables.robolectricSdkVersion}} -PpowerLiftApiKey=$(powerliftApiKey) -PcodeCoverageEnabled=true ${{variables.shouldSkipLongRunningTest}}
         jdkArchitecture: x64
-        jdkVersionOption: "1.17"
+        jdkVersionOption: "1.21"

azure-pipelines/pull-request-validation/common.yml

@@ -43,7 +43,7 @@ stages:
         displayName: Assemble Local
         inputs:
           javaHomeSelection: JDKVersion
-          jdkVersionOption: "1.17"
+          jdkVersionOption: "1.21"
           tasks: clean common:assembleLocal
           publishJUnitResults: false
           jdkArchitecture: x64
@@ -53,14 +53,14 @@ stages:
         displayName: Run Unit tests
         inputs:
           javaHomeSelection: JDKVersion
-          jdkVersionOption: "1.17"
+          jdkVersionOption: "1.21"
           tasks: common:jacocoTestReport -PlabSecret=$(LabVaultAppCert) -PmockApiUrl=$(MOCK_API_URL) -PnativeAuthConfigString=$(NATIVE_AUTH_CONFIG_STRING)
       - task: Gradle@3
         displayName: Check Dependencies size
         condition: eq(variables['system.pullRequest.targetBranch'], 'dev')
         inputs:
           tasks: common:dependenciesSizeCheck -PdependenciesSizeCheckConfig=distReleaseRuntimeClasspath
-          jdkVersionOption: "1.17"
+          jdkVersionOption: "1.21"
       - script: tree "$(Build.SourcesDirectory)" /F /A
         displayName: 'Print File Structure Tree'
       - publish: $(Build.SourcesDirectory)/common/build/reports/jacoco/jacocoTestReport/jacocoTestReport.xml
@@ -151,7 +151,7 @@ stages:
           tasks: clean common:lintLocalDebug
           publishJUnitResults: false
           javaHomeSelection: JDKVersion
-          jdkVersionOption: "1.17"
+          jdkVersionOption: "1.21"
 
   - template: ../code-coverage/compare-code-coverage.yml
     parameters:

azure-pipelines/pull-request-validation/common4j.yml

@@ -42,7 +42,7 @@ stages:
           cwd: $(Build.SourcesDirectory)/common-java-root
           tasks: clean common4j:assemble
           javaHomeOption: JDKVersion
-          jdkVersionOption: 1.17
+          jdkVersionOption: 1.21
       - template: ../templates/steps/spotbugs.yml
         parameters:
           project: common4j
@@ -54,7 +54,7 @@ stages:
           cwd: $(Build.SourcesDirectory)/common-java-root
           tasks: common4j:jacocoTestReport -Psugar=true -PmockApiUrl=$(MOCK_API_URL) -PnativeAuthConfigString=$(NATIVE_AUTH_CONFIG_STRING)
           javaHomeOption: JDKVersion
-          jdkVersionOption: 1.17
+          jdkVersionOption: 1.21
       - script: tree "$(Build.SourcesDirectory)" /F /A
         displayName: 'Print File Structure Tree'
       - publish: $(Build.SourcesDirectory)/common4j/build/reports/jacoco/test/jacocoTestReport.xml
@@ -90,11 +90,6 @@ stages:
             tasks: clean common4j:assemble
             javaHomeOption: JDKVersion
             jdkVersionOption: 1.17
-        - template: ../templates/steps/spotbugs.yml
-          parameters:
-            project: common4j
-            cwd: $(Build.SourcesDirectory)/common-java-root
-            spotbugsCommand: spotbugsMain
         - task: Gradle@2
           displayName: Run the unit tests.
           inputs:
@@ -107,6 +102,17 @@ stages:
         - publish: $(Build.SourcesDirectory)/common4j/build/reports/jacoco/test/jacocoTestReport.xml
           artifact: jacocoReportDev
           displayName: 'Publish JaCoCo Report Artifact (Dev Branch)'
+        # SpotBugs runs LAST on the dev baseline: this job's only deliverable is jacocoReportDev
+        # for the coverage comparison, so a SpotBugs failure on dev's (pre-upgrade) code must not
+        # halt the job before the coverage artifact is published.
+        # javaVersion pinned to 1.17: dev's pre-upgrade SpotBugs (4.7.x) crashes under JDK 21
+        # (System.setSecurityManager UnsupportedOperationException); JDK 17 lets it run cleanly.
+        - template: ../templates/steps/spotbugs.yml
+          parameters:
+            project: common4j
+            cwd: $(Build.SourcesDirectory)/common-java-root
+            spotbugsCommand: spotbugsMain
+            javaVersion: "1.17"
 
   - template: ../code-coverage/compare-code-coverage.yml
     parameters:

azure-pipelines/pull-request-validation/lab-utilities.yml

@@ -36,7 +36,7 @@ jobs:
           cwd: $(Build.SourcesDirectory)/common-java-root
           tasks: LabApiUtilities:clean LabApiUtilities:assemble
           javaHomeSelection: JDKVersion
-          jdkVersionOption: "1.17"
+          jdkVersionOption: "1.21"
       - template: ../templates/steps/spotbugs.yml
         parameters:
           project: LabApiUtilities
@@ -48,5 +48,5 @@ jobs:
           cwd: $(Build.SourcesDirectory)/common-java-root
           tasks: LabApiUtilities:test -Psugar=true -PlabSecret=$(LabVaultAppCert)
           javaHomeSelection: JDKVersion
-          jdkVersionOption: "1.17"
+          jdkVersionOption: "1.21"
 ...

azure-pipelines/templates/steps/continuous-delivery/assemble-publish-projversion.yml

@@ -36,19 +36,19 @@ steps:
   displayName: Assemble ${{ parameters.project }} ${{ parameters.variant }}
   inputs:
     javaHomeSelection: JDKVersion
-    jdkVersionOption: "1.17"
+    jdkVersionOption: "1.21"
     tasks: '${{ parameters.project }}:clean ${{ parameters.project }}:assemble${{ parameters.variant }} ${{ parameters.buildArguments }}'
 - task: Gradle@2
   displayName: Publish
   inputs:
     javaHomeSelection: JDKVersion
-    jdkVersionOption: "1.17"
+    jdkVersionOption: "1.21"
     tasks: '${{ parameters.project }}:publish${{ parameters.variant }} ${{ parameters.buildArguments }}'
 - task: Gradle@2
   displayName: Run unit tests
   inputs:
     javaHomeSelection: JDKVersion
-    jdkVersionOption: "1.17"
+    jdkVersionOption: "1.21"
     tasks: '${{ parameters.project }}:test${{ parameters.variant }} -PlabSecret=$(LabVaultAppCert)'
 - ${{ if ne(parameters.artifactFolder, '') }}:
   - task: CopyFiles@2

azure-pipelines/templates/steps/spotbugs.yml

@@ -11,7 +11,7 @@ parameters:
 - name: cwd
   default: $(Build.SourcesDirectory)
 - name: javaVersion
-  default: "1.17"
+  default: "1.21"
 steps:
 - bash: |
     echo "##vso[task.setvariable variable=ENV_VSTS_MVN_CRED_USERNAME]VSTS"

changelog.txt

@@ -1,5 +1,6 @@
 vNext
 ----------
+- [MINOR] Upgrade build toolchain to Gradle 9.3.1, Android Gradle Plugin 9.1.1, compileSdk/buildToolsVersion 37 (targetSdk unchanged at 36), Kotlin 2.2.21 and JDK 21; bump Robolectric to 4.16.1 for API 37 test compatibility, and adapt SpotBugs 6.x, JaCoCo and dependency configuration accordingly (#3186)
 
 Version 24.5.0
 ----------

common/build.gradle

@@ -1,10 +1,11 @@
+import org.jetbrains.kotlin.gradle.dsl.JvmTarget
+
 plugins {
-    id 'com.microsoft.identity.buildsystem' version '0.2.5'
+    id 'com.microsoft.identity.buildsystem' version '0.2.6'
     id 'com.android.library'
     id 'pmd'
     id 'checkstyle'
     id 'maven-publish'
-    id 'kotlin-android'
     id 'jacoco'
 
     // Test retries
@@ -14,10 +15,51 @@ plugins {
 
 apply from: '../versioning/version_tasks.gradle'
 
+// Built-in Kotlin (AGP 9): replaces the android { kotlinOptions { } } block that the
+// removed 'kotlin-android' plugin previously provided.
+kotlin {
+    compilerOptions {
+        jvmTarget = JvmTarget.JVM_1_8
+    }
+}
+
 buildSystem {
     desugar = false
 }
 
+// Robolectric 4.16.1 -> Guava 33.4.8-jre pulls org.jspecify:jspecify:1.0.0, which is not mirrored
+// in the internal Maven feed (CI fails to resolve the jar). jspecify provides compile-time-only
+// nullability annotations for Guava's API; they are not required to compile or run against Guava,
+// so we exclude the transitive rather than block on the feed. Remove this once the feed mirrors it.
+configurations.all {
+    exclude group: 'org.jspecify', module: 'jspecify'
+}
+
+// --- SpotBugs 6.x adjustments (repo-local; NOT in the shared buildsystem plugin) ---
+// The Gradle 9 upgrade forced spotbugs-gradle-plugin 4.7.x -> 6.x, which changed two things.
+// Both fixes are kept here (repo-scoped) rather than in the shared buildsystem plugin, so other
+// consumers (msal, broker) are unaffected until they upgrade.
+//
+// 1) Windows-only launch fix: the Android SpotBugs task factory sets
+//    sourceDirs = javaCompile.getSource() (~225 .java files), and SpotBugsRunner emits
+//    `-sourcepath <all those files>`, which exceeds the Windows ~32,767-char command-line limit
+//    (CreateProcess error=206) so the analysis process fails to start. Clearing sourceDirs drops
+//    -sourcepath (it only enriches report rendering, not the analysis). Gated to Windows so
+//    CI (Linux) is unchanged; run in afterEvaluate so it wins over the factory.
+if (org.gradle.internal.os.OperatingSystem.current().isWindows()) {
+    afterEvaluate {
+        tasks.withType(com.github.spotbugs.snom.SpotBugsTask).configureEach { t ->
+            t.sourceDirs.setFrom()
+        }
+    }
+}
+
+// 2) SpotBugs 6.x reports medium-confidence findings on pre-existing (unchanged) code that
+//    4.7.x did not, which would newly fail the build. Those specific detectors are suppressed
+//    repo-locally in config/spotbugs/exclude.xml (see its "SpotBugs 6.x" section) so behaviour
+//    matches the pre-upgrade baseline while leaving all other detectors active. Kept out of the
+//    shared buildsystem plugin so other consumers are unaffected until they upgrade.
+
 def enableCodeCoverage = false
 
 if (project.hasProperty("codeCoverageEnabled")) {
@@ -63,7 +105,7 @@ tasks.register("jacocoTestReport", JacocoReport) {
     ]
 
     def kotlinClasses = fileTree(
-            dir: "$buildDir/tmp/kotlin-classes/localDebug",
+            dir: "$buildDir/intermediates/built_in_kotlinc/localDebug/compileLocalDebugKotlin/classes",
             excludes: fileFilter
     )
 
@@ -109,7 +151,7 @@ android {
         targetSdkVersion rootProject.ext.targetSdkVersion
         versionCode getAppVersionCode()
         versionName getAppVersionName()
-        project.archivesBaseName = "common"
+        project.base.archivesName = "common"
         project.version = android.defaultConfig.versionName
         testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
         //Languages Common supports.
@@ -126,6 +168,13 @@ android {
         buildConfig = true
         aidl = true
     }
+
+    // AGP 9: software components for publishing are no longer auto-created; each
+    // variant that is published via `from components.<name>` must be declared here.
+    publishing {
+        singleVariant("distRelease") {}
+        singleVariant("distDebug") {}
+    }
     buildTypes {
         debug {
             testCoverageEnabled enableCodeCoverage
@@ -134,7 +183,7 @@ android {
         release {
             minifyEnabled false
             debuggable false
-            proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-rules.pro'
+            proguardFiles getDefaultProguardFile('proguard-android-optimize.txt'), 'proguard-rules.pro'
             consumerProguardFiles 'consumer-rules.pro'
         }
     }
@@ -144,10 +193,6 @@ android {
         targetCompatibility JavaVersion.VERSION_1_8
     }
 
-    kotlinOptions {
-        jvmTarget = "1.8"
-    }
-
     lintOptions {
         abortOnError true
         disable 'MissingPermission'
@@ -201,7 +246,7 @@ android {
 
     libraryVariants.all { variant ->
         variant.outputs.all {
-            outputFileName = "${archivesBaseName}-${version}.aar"
+            outputFileName = "${project.base.archivesName.get()}-${version}.aar"
         }
     }
 }

common/src/test/java/com/microsoft/identity/common/internal/util/AndroidKeyStoreUtilTest.java

@@ -495,7 +495,7 @@ public void testGetKeyPairEncryptionPaddings_ModernAPI_RuntimeException_ThrowsCl
     }
 
     @Test
-    @Config(sdk = Build.VERSION_CODES.LOLLIPOP) // API 21
+    @Config(sdk = Build.VERSION_CODES.M) // API 23 (Robolectric 4.16 dropped SDK 21/22 emulation; the failure path here is SDK-independent - it comes from the mocked KeyPair failing, not the API level)
     public void testGetKeyPairEncryptionPaddings_LegacyAPI_ThrowsClientException() {
         // Act
         try {