Release v1.8.180 — catalog: promote hardcoded testImpl strings; reject "dead pin" claim

Three test deps in app/build.gradle.kts were hardcoded coordinate strings
("androidx.compose.ui:ui-test-junit4", "androidx.test:runner:1.7.0",
"junit:junit:4.13.2"), bypassing the version catalog. Dependabot's grouped
update rules (android-test-tooling pattern in .github/dependabot.yml) skipped
them, and bumps required hand-editing the .kts. Promoted all three to
libs.versions.toml entries.

New catalog rows (additive, no edits to existing live pins):
  [versions] androidx-test-runner = "1.7.0"
  [versions] junit4 = "4.13.2"
  [libraries] androidx-test-runner    = "androidx.test:runner"
  [libraries] androidx-compose-ui-test-junit4 = "androidx.compose.ui:ui-test-junit4"   # compose-BOM-managed
  [libraries] junit4                  = "junit:junit"

app/build.gradle.kts now consumes them via libs.* accessors.

JUnit 4 is intentionally pinned because Robolectric's @RunWith and
Compose's createComposeRule() ship as JUnit-4 rules; junit-vintage-engine
bridges them onto the project-wide useJUnitPlatform() runner. Kotest 6
remains the primary test framework.

RESEARCH_FEATURE_PLAN.md F33 ("coil + material-kolor are dead pins") was
investigated and rejected: both are live in sibling library modules.
lib/snygg/build.gradle.kts:103-104 uses libs.coil.compose + libs.coil.gif;
lib/color/build.gradle.kts:60 uses libs.material.kolor. The catalog entries
stay; F33 is closed as rejected.

Closes RESEARCH_FEATURE_PLAN.md F34.

Verification:
- grep -E "implementation\(\"[a-z.]+:[a-z-]+" app/build.gradle.kts -> 0 matches
- grep -rn "libs\.coil\|libs\.material\.kolor" lib/ -> expected matches in
  lib/snygg/build.gradle.kts and lib/color/build.gradle.kts
- bash scripts/check-fastlane-metadata.sh -> OK (versionCode 1980)
- bash scripts/check-repo-hygiene.sh -> OK
- Gradle compile + Dependabot grouping verification deferred to maintainer
  host per CLAUDE.md

Author: SysAdminDoc

CHANGELOG.md

@@ -2,6 +2,53 @@
 
 All SwiftFloris release history is consolidated here. This replaces the former root-level `RELEASE_NOTES_v*.md` file-per-release pattern.
 
+<a id="v1.8.180"></a>
+## v1.8.180
+
+Released: 2026-05-25
+
+### Version catalog hygiene (RESEARCH_FEATURE_PLAN.md F34; F33 investigated and rejected)
+
+The 2026-05-25 build/CI reconnaissance pass flagged three hardcoded `testImplementation` coordinate strings in [`app/build.gradle.kts`](app/build.gradle.kts) lines 498–500 (`"androidx.compose.ui:ui-test-junit4"`, `"androidx.test:runner:1.7.0"`, `"junit:junit:4.13.2"`). Hardcoded strings bypass the version catalog, which means Dependabot's grouped Android-runtime / Android-test-tooling update rules (`.github/dependabot.yml`) skip them, and bumps require hand-editing the `.kts` file instead of a single catalog entry.
+
+The same pass also claimed `coil` and `material-kolor` were dead catalog pins (F33). Verification on this run found both are actively consumed by sibling library modules: `lib/snygg/build.gradle.kts:103-104` uses `libs.coil.compose` + `libs.coil.gif`, and `lib/color/build.gradle.kts:60` uses `libs.material.kolor`. The "dead pin" claim came from grepping only `app/`, which missed the sibling modules. F33 is therefore rejected and the catalog entries remain.
+
+### Changes
+
+- **`gradle/libs.versions.toml`** — added three new entries:
+  - `[versions] androidx-test-runner = "1.7.0"`
+  - `[versions] junit4 = "4.13.2"`
+  - `[libraries] androidx-test-runner = { module = "androidx.test:runner", version.ref = "androidx-test-runner" }`
+  - `[libraries] androidx-compose-ui-test-junit4 = { module = "androidx.compose.ui:ui-test-junit4" }` (no `version.ref` — coordinate is managed by the existing `androidx-compose-bom`)
+  - `[libraries] junit4 = { module = "junit:junit", version.ref = "junit4" }`
+- **`app/build.gradle.kts:498-500`** — replaced the three hardcoded coordinate strings with their new catalog accessors:
+  - `testImplementation("androidx.compose.ui:ui-test-junit4")` → `testImplementation(libs.androidx.compose.ui.test.junit4)`
+  - `testImplementation("androidx.test:runner:1.7.0")` → `testImplementation(libs.androidx.test.runner)`
+  - `testImplementation("junit:junit:4.13.2")` → `testImplementation(libs.junit4)`
+
+### Why JUnit 4 is still pinned
+
+JUnit 4 is **not** a primary test framework here — the project's main test runner is Kotest 6 on JUnit Platform (`useJUnitPlatform()` per the existing `tasks.withType<Test>` block). The JUnit-4 transitive surface stays because Robolectric's `@RunWith(RobolectricTestRunner::class)` rule and Compose's `createComposeRule()` ship as JUnit-4 rules, and `junit-vintage-engine` bridges them onto the JUnit-Platform runner. Pinning `junit:junit:4.13.2` (the last stable JUnit 4) keeps the bridge deterministic. JUnit 5 / JUnit Platform stays the primary runner for new tests.
+
+### Verification
+
+- `bash scripts/check-repo-hygiene.sh` → OK.
+- `bash scripts/check-fastlane-metadata.sh` → OK (versionCode 1980).
+- `git diff gradle/libs.versions.toml` shows only the three additive entries; no edits to existing live pins.
+- `grep -E "implementation\(\"[a-z.]+:[a-z-]+" app/build.gradle.kts` returns no remaining hardcoded coordinate strings.
+- Sibling-module usage confirmed: `grep -rn "libs\.coil\|libs\.material\.kolor" lib/` returns the expected matches in `lib/snygg/build.gradle.kts` and `lib/color/build.gradle.kts`.
+- Gradle compile + Dependabot grouping verification deferred to maintainer host per `CLAUDE.md`.
+
+### Files Touched
+
+- `gradle/libs.versions.toml`
+- `app/build.gradle.kts`
+- `fastlane/metadata/android/en-US/changelogs/1980.txt` (new)
+- `gradle.properties` (versionCode 1979→1980, versionName 1.8.179→1.8.180)
+- `README.md` (version badge)
+- `CHANGELOG.md` (this section)
+- `RESEARCH_FEATURE_PLAN.md` (tick F34, mark F33 rejected with reason)
+
 <a id="v1.8.179"></a>
 ## v1.8.179
 

README.md

@@ -1,6 +1,6 @@
 # SwiftFloris
 
-![Version](https://img.shields.io/badge/version-v1.8.179-blue) ![License](https://img.shields.io/badge/license-Apache%202.0-green) ![Platform](https://img.shields.io/badge/platform-Android%208.0+-orange) ![Network](https://img.shields.io/badge/network-none-lightgrey) ![SwiftKey migration](https://img.shields.io/badge/SwiftKey%20migration-window%20closes%202026--05--31-red)
+![Version](https://img.shields.io/badge/version-v1.8.180-blue) ![License](https://img.shields.io/badge/license-Apache%202.0-green) ![Platform](https://img.shields.io/badge/platform-Android%208.0+-orange) ![Network](https://img.shields.io/badge/network-none-lightgrey) ![SwiftKey migration](https://img.shields.io/badge/SwiftKey%20migration-window%20closes%202026--05--31-red)
 
 **SwiftFloris** is a privacy-first Android keyboard, forked from FlorisBoard and pushed toward SwiftKey-class multilingual typing without the cloud. It ships under Apache-2.0, holds no `INTERNET` permission, and binds zero accounts.
 

RESEARCH_FEATURE_PLAN.md

@@ -1021,9 +1021,9 @@ The items above promote to:
 
 - [ ] **P2** — F32 — **Empty `try/catch (_: Throwable)` audit**. Replace silent drops at `TextKeyData.kt:637/656` and `FlorisImeService.kt:758` with `flogWarning`. Touches: those two files. Complexity: S.
 
-- [ ] **P2** — F33 — **Delete dead catalog pins** `coil` and `material-kolor` from `libs.versions.toml`. Update PROJECT_CONTEXT.md §3 to match. Complexity: S.
+- [~] **P2** — F33 — **Delete dead catalog pins** `coil` and `material-kolor`. **Rejected on investigation (2026-05-25)**: both are actively consumed by sibling library modules — `lib/snygg/build.gradle.kts:103-104` uses `libs.coil.compose` + `libs.coil.gif`, and `lib/color/build.gradle.kts:60` uses `libs.material.kolor`. The original claim came from grepping only `app/` source; the catalog pins are live.
 
-- [ ] **P2** — F34 — **Move hard-coded `testImplementation` strings** at `app/build.gradle.kts:498-500` into the version catalog so Dependabot can update them. Complexity: S.
+- [x] **P2** — F34 — **Move hard-coded `testImplementation` strings** at `app/build.gradle.kts:498-500` into the version catalog so Dependabot can update them. Complexity: S. **Shipped v1.8.180 (2026-05-25)** — promoted `androidx-test-runner`, `junit4`, and `androidx-compose-ui-test-junit4` (compose-BOM-managed, no version ref) into `libs.versions.toml`; `app/build.gradle.kts` consumes them via `libs.*` accessors.
 
 - [x] **P2** — F35 — **Refresh `docs/THREAT_MODEL.md`** — currently 105 versions stale. Reflect v1.8.104-122 privacy regressions closed + addon trust pin store. Complexity: M. **Shipped v1.8.176 (2026-05-25)** — added a 20-bullet "What changed since the v1.8.68 baseline" audit-trail section covering v1.8.85 → v1.8.175.
 

app/build.gradle.kts

@@ -495,9 +495,9 @@ dependencies {
     testImplementation(libs.roborazzi.junit.rule)
     testImplementation(libs.robolectric)
     testImplementation(libs.androidx.test.ext)
-    testImplementation("androidx.compose.ui:ui-test-junit4")
-    testImplementation("androidx.test:runner:1.7.0")
-    testImplementation("junit:junit:4.13.2")
+    testImplementation(libs.androidx.compose.ui.test.junit4)
+    testImplementation(libs.androidx.test.runner)
+    testImplementation(libs.junit4)
     testRuntimeOnly(libs.junit.vintage.engine)
     androidTestImplementation(libs.androidx.test.ext)
     androidTestImplementation(libs.androidx.test.espresso.core)

fastlane/metadata/android/en-US/changelogs/1980.txt

@@ -0,0 +1,5 @@
+v1.8.180 — version catalog: promote hardcoded testImpl strings.
+
+Three testImplementation coordinate strings in app/build.gradle.kts ("androidx.compose.ui:ui-test-junit4", "androidx.test:runner:1.7.0", "junit:junit:4.13.2") now live in libs.versions.toml so Dependabot can update them. Investigated coil + material-kolor as supposed dead pins; both are live in lib/snygg + lib/color, kept.
+
+No app behaviour changes.

gradle.properties

@@ -15,5 +15,5 @@ projectMinSdk=26
 projectTargetSdk=36
 projectCompileSdk=36
 
-projectVersionCode=1979
-projectVersionName=1.8.179
+projectVersionCode=1980
+projectVersionName=1.8.180

gradle/libs.versions.toml

@@ -32,7 +32,9 @@ zxing-core = "3.5.4"
 androidx-benchmark = "1.4.1"
 androidx-test-ext = "1.3.0"
 androidx-test-espresso = "3.7.0"
+androidx-test-runner = "1.7.0"
 androidx-test-uiautomator = "2.3.0"
+junit4 = "4.13.2"
 kotest = "6.1.11"
 junit-vintage = "6.0.3"
 kotlinx-kover = "0.9.8"
@@ -87,7 +89,10 @@ zxing-core = { module = "com.google.zxing:core", version.ref = "zxing-core" }
 androidx-benchmark-macro = { module = "androidx.benchmark:benchmark-macro-junit4", version.ref = "androidx-benchmark" }
 androidx-test-ext = { module = "androidx.test.ext:junit", version.ref = "androidx-test-ext" }
 androidx-test-espresso-core = { module = "androidx.test.espresso:espresso-core", version.ref = "androidx-test-espresso" }
+androidx-test-runner = { module = "androidx.test:runner", version.ref = "androidx-test-runner" }
 androidx-test-uiautomator = { module = "androidx.test.uiautomator:uiautomator", version.ref = "androidx-test-uiautomator" }
+androidx-compose-ui-test-junit4 = { module = "androidx.compose.ui:ui-test-junit4" }
+junit4 = { module = "junit:junit", version.ref = "junit4" }
 kotest-assertions-core = { module = "io.kotest:kotest-assertions-core", version.ref = "kotest" }
 kotest-property = { module = "io.kotest:kotest-property", version.ref = "kotest" }
 kotest-runner-junit5 = { module = "io.kotest:kotest-runner-junit5", version.ref = "kotest" }