Skip to content

build: update Gradle 8.14.5 and AGP 8.13.2#7

Merged
hawkff merged 2 commits into
mainfrom
maintenance/update-android-build-stack
Jun 15, 2026
Merged

build: update Gradle 8.14.5 and AGP 8.13.2#7
hawkff merged 2 commits into
mainfrom
maintenance/update-android-build-stack

Conversation

@hawkff

@hawkff hawkff commented Jun 15, 2026

Copy link
Copy Markdown
Owner

Summary

Updates the Android build system to the latest 8.x line. Build-system only — no app
dependency or Kotlin changes.

Component Before After
Gradle 8.10.2 8.14.5
Android Gradle Plugin 8.8.1 8.13.2
Kotlin 2.0.21 2.0.21 (unchanged)
KSP 2.0.21-1.0.27 unchanged

Why Kotlin/KSP are intentionally NOT bumped here

I attempted Kotlin 2.1.21 + KSP 2.1.21-2.0.2 first. It fails the build: KSP 2.1.x
defaults to KSP2, and Room 2.6.1's generated DAO is incompatible —

ProxyGroup_Dao_Impl.java: name clash: subscriptions(Continuation<List<ProxyGroup>>) ...
  has the same erasure ... error: ... is not abstract and does not override abstract method
  subscriptions(Continuation<? super List<ProxyGroup>>)

Kotlin/KSP is tightly coupled to Room (an app dependency). Per the branch scope
(build system only, no app-dependency changes), the Kotlin/KSP/Room upgrade is deferred
to the app-dependencies phase, where Room can move in lockstep with Kotlin.

AGP 8.13.2 officially supports the Kotlin 2.0.x line, so keeping Kotlin 2.0.21 is a
valid, supported configuration (verified by a clean debug and release build).

Note on the automated review suggestion to bump Kotlin to 2.3.10: rejected for this
branch. It is a "stay current" recommendation, not a correctness fix; the current
combo builds cleanly, and bumping Kotlin that far would force KSP 2.3.x + a Room
upgrade — out of scope here and deferred to the app-dependencies phase.

Verification (AWS Linux builder)

  • ./gradlew app:assembleOssDebug — BUILD SUCCESSFUL.
  • ./gradlew app:assembleOssRelease — BUILD SUCCESSFUL (R8 minify, lintVital with
    warningsAsErrors=true, resource shrinking, ART profile, core desugaring all pass).
  • Native libcore.aar unchanged (not rebuilt; no core/Go changes).

Scope

  • 2 files: gradle/wrapper/gradle-wrapper.properties, buildSrc/build.gradle.kts.
  • No source, no app dependencies, no Kotlin/KSP, no go.mod/core changes.

Build-system update only (no app dependency or Kotlin changes):
- Gradle 8.10.2 -> 8.14.5
- Android Gradle Plugin 8.8.1 -> 8.13.2 (requires Gradle 8.13+)

Kotlin/KSP intentionally kept at 2.0.21 / 2.0.21-1.0.27: bumping Kotlin to
2.1.x switches KSP to KSP2, which breaks Room 2.6.1's generated DAO code
(suspend Continuation variance mismatch). The Kotlin/KSP/Room upgrade is
deferred to the app-dependencies phase where Room can move in lockstep.
@coderabbitai

coderabbitai Bot commented Jun 15, 2026

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: cb17e686-b35e-4e06-8e0f-a225b718da45

📥 Commits

Reviewing files that changed from the base of the PR and between 36629b3 and 851b535.

📒 Files selected for processing (1)
  • gradle/wrapper/gradle-wrapper.properties
🚧 Files skipped from review as they are similar to previous changes (1)
  • gradle/wrapper/gradle-wrapper.properties

📝 Walkthrough

Summary by CodeRabbit

  • Chores
    • Updated Android build tool dependencies to latest stable versions for improved build performance and compatibility.

Walkthrough

Two build toolchain version bumps: the Gradle wrapper distribution URL is updated from 8.10.2 to 8.14.5 with the corresponding checksum, and the Android Gradle Plugin dependency in buildSrc/build.gradle.kts is bumped from 8.8.1 to 8.13.2.

Changes

Build Toolchain Upgrade

Layer / File(s) Summary
Gradle wrapper and AGP version bumps
gradle/wrapper/gradle-wrapper.properties, buildSrc/build.gradle.kts
distributionUrl updated to Gradle 8.14.5 with matching checksum, and com.android.tools.build:gradle bumped to 8.13.2.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Poem

A hop and a skip through version land,
Gradle and AGP, freshly planned,
8.14.5 now wraps the build tight,
8.13.2 keeps the plugins right,
This bunny approves — all green, all bright! 🐇✨

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Title check ✅ Passed The title accurately and concisely summarizes the main changes: updating Gradle to 8.14.5 and AGP to 8.13.2, which directly matches the two files modified in the changeset.
Description check ✅ Passed The description is comprehensive and directly related to the changeset, providing clear rationale for version choices, technical constraints, and verification details.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.


Comment @coderabbitai help to get the list of available commands and usage tips.

@hawkff hawkff marked this pull request as ready for review June 15, 2026 16:40
@hawkff

hawkff commented Jun 15, 2026

Copy link
Copy Markdown
Owner Author

@coderabbitai full review

Please focus on build reproducibility and Gradle/AGP compatibility. Note: Kotlin/KSP are intentionally kept at 2.0.21 because bumping to 2.1.x+ switches KSP to KSP2 which breaks Room 2.6.1 codegen (verified build failure). AGP 8.13.2 supports Kotlin 2.0.x. The Kotlin/KSP/Room upgrade is deferred to the app-dependencies phase. Both assembleOssDebug and assembleOssRelease pass on the builder.

@coderabbitai

coderabbitai Bot commented Jun 15, 2026

Copy link
Copy Markdown
🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== gradle/wrapper/gradle-wrapper.properties ==="
cat gradle/wrapper/gradle-wrapper.properties

echo ""
echo "=== buildSrc/build.gradle.kts ==="
cat buildSrc/build.gradle.kts

echo ""
echo "=== buildSrc/src/main/java/Versions.kt (if exists) ==="
fd -e kt . buildSrc/src | head -20
fd -e kts . buildSrc | head -20

echo ""
echo "=== Any other version files ==="
fd "versions.gradle" . | head -5
fd "libs.versions.toml" . | head -5
cat gradle/libs.versions.toml 2>/dev/null || echo "(no libs.versions.toml)"

Length of output: 1318


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== Checking Gradle 8.14.5 checksum from Gradle official releases ==="
# The gradle-wrapper.properties should have a distributionSha256Sum for build reproducibility
grep -i "sha256\|checksum\|verification" gradle/wrapper/gradle-wrapper.properties || echo "(no checksum found in wrapper properties)"

echo ""
echo "=== gradle-wrapper.jar hash (for wrapper integrity) ==="
sha256sum gradle/wrapper/gradle-wrapper.jar 2>/dev/null || echo "(no gradle-wrapper.jar found)"

echo ""
echo "=== gradle/verification-metadata.xml (dependency verification) ==="
ls -la gradle/ || true
cat gradle/verification-metadata.xml 2>/dev/null | head -50 || echo "(no verification-metadata.xml)"

echo ""
echo "=== settings.gradle.kts - check for pluginManagement/dependencyResolutionManagement ==="
cat settings.gradle.kts 2>/dev/null || cat settings.gradle 2>/dev/null || echo "(no settings file found at root)"

echo ""
echo "=== build.gradle.kts (root) ==="
cat build.gradle.kts 2>/dev/null || cat build.gradle 2>/dev/null || echo "(no root build file)"

Length of output: 2086


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== repositories.gradle.kts ==="
cat repositories.gradle.kts

echo ""
echo "=== buildSrc/src/main/kotlin/Helpers.kt ==="
cat buildSrc/src/main/kotlin/Helpers.kt

echo ""
echo "=== app/build.gradle.kts (check AGP plugin application and compileSdk) ==="
cat app/build.gradle.kts 2>/dev/null || cat app/build.gradle 2>/dev/null || echo "(not found)"

echo ""
echo "=== Check if gradle-wrapper.jar is tracked ==="
git ls-files gradle/wrapper/ 2>/dev/null || echo "(git not available or no tracked files)"

echo ""
echo "=== Any .gitignore entries for wrapper ==="
grep -r "wrapper" .gitignore 2>/dev/null || echo "(no wrapper entries in .gitignore)"

Length of output: 11367


🌐 Web query:

AGP Android Gradle Plugin 8.13.2 minimum required Gradle version compatibility

Length of output: 12630



@hawkff: Here is the full review, focused on build reproducibility and Gradle/AGP compatibility.


Review: build: update Gradle 8.14.5 and AGP 8.13.2

✅ Version Compatibility — All Pass

Check Result
AGP 8.13.x requires minimum Gradle 8.13 (official matrix) Gradle 8.14.5 ≥ 8.13 ✅
AGP 8.13.2 supports Kotlin 2.0.x Kotlin 2.0.21 ✅
AGP 8.13.x requires SDK Build Tools ≥ 35.0.0 buildToolsVersion = "35.0.1"
AGP 8.13.x max compileSdk = 36.1 compileSdk = 35
KSP 2.0.21-1.0.27 / Room 2.6.1 unchanged
gradle-wrapper.jar tracked in git
Kotlin/KSP intentionally held at 2.0.21 to avoid KSP2 + Room 2.6.1 breakage Rationale sound ✅

AGP 8.13.2's R8 (8.13.19) adds support for processing Kotlin 2.3 metadata, but this is additive — it will not affect output compiled with Kotlin 2.0.21.


⚠️ Build Reproducibility Finding — Missing Wrapper Checksum

File: gradle/wrapper/gradle-wrapper.properties

The distributionSha256Sum property is absent. Without it, gradlew will download and execute whatever binary is served at the distributionUrl with no integrity verification. This is the single most impactful reproducibility gap in scope for this PR.

The official SHA-256 for gradle-8.14.5-bin.zip can be obtained from the Gradle releases page or its checksum file. Adding it locks the exact binary:

distributionBase=GRADLE_USER_HOME
distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.5-bin.zip
distributionSha256Sum=<sha256-of-gradle-8.14.5-bin.zip>
distributionPath=wrapper/dists
zipStorePath=wrapper/dists
zipStoreBase=GRADLE_USER_HOME

You can verify the hash with:

curl -sL https://services.gradle.org/distributions/gradle-8.14.5-bin.zip.sha256

Note: If this project has never included distributionSha256Sum and you prefer to keep it that way for consistency, this is acceptable — just worth flagging explicitly.


ℹ️ Pre-existing Issues (Out of Scope — No Action Required)

These existed before this PR and are unaffected by the bump:

  • No gradle/verification-metadata.xml — plugin/dependency checksums are not verified. Consider enabling Gradle dependency verification in a future PR.
  • allprojects {} in root build.gradle.kts — deprecated in Gradle 8.x; Gradle recommends migrating to buildscript blocks or convention plugins.
  • KotlinJvmOptions in Helpers.kt (Line 82) — deprecated since Kotlin Gradle plugin 2.0; the replacement is the compilerOptions {} DSL. Will generate warnings but not errors.
  • applicationVariants.forEach in setupCommon() — uses the old Variant API. Not an error but will generate deprecation warnings in AGP 8.13.x.

Summary

The version bump is correct and safe. Gradle 8.14.5 satisfies AGP 8.13.x's minimum Gradle requirement of 8.13, and the intentional hold on Kotlin 2.0.21 / KSP 1.0.27 / Room 2.6.1 is the right call for this scope. The only actionable item within this PR's scope is the missing distributionSha256Sum. Everything else is pre-existing. The PR is approvable as-is with the checksum addition being a recommended (not blocking) hardening.

✅ Action performed

Full review finished.

Add distributionSha256Sum for gradle-8.14.5-bin.zip so the wrapper verifies
the downloaded distribution against the official checksum (supply-chain
hardening).
@hawkff

hawkff commented Jun 15, 2026

Copy link
Copy Markdown
Owner Author

@coderabbitai review

Added distributionSha256Sum=6f74b601...e854 (official checksum for gradle-8.14.5-bin.zip). Verified on the builder: wiped the wrapper dist cache, re-downloaded, checksum verification passed, build green. The other noted items (verification-metadata.xml, allprojects{}, KotlinJvmOptions, applicationVariants API) are pre-existing and out of scope.

@coderabbitai

coderabbitai Bot commented Jun 15, 2026

Copy link
Copy Markdown

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== Current gradle-wrapper.properties ==="
cat gradle/wrapper/gradle-wrapper.properties

echo ""
echo "=== Official Gradle 8.14.5-bin.zip SHA256 ==="
curl -fsSL https://services.gradle.org/distributions/gradle-8.14.5-bin.zip.sha256

Length of output: 756



@hawkff: Checksum verified — distributionSha256Sum in the file matches the official Gradle distribution exactly:

6f74b601422d6d6fc4e1f9a1ab6522f642c2fdcbc15ae33ebd30ba3d7198e854  ✅

All items from the full review are now resolved:

Item Status
Gradle 8.14.5 / AGP 8.13.2 compatibility
Kotlin 2.0.21 / KSP held intentionally
distributionSha256Sum added and verified
Pre-existing items (out of scope) Acknowledged

The PR is clean. Approving.

[approve]

@hawkff hawkff merged commit a9517d7 into main Jun 15, 2026
3 checks passed
@hawkff hawkff deleted the maintenance/update-android-build-stack branch June 15, 2026 16:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant