[alexgerardojacinto]

Description

Part of RMET-5348: update the native Android libraries' build tooling and dependencies, keeping a single major version for all consumers (MABS 11.2 / 12.1 / 13, Capacitor 8 and 9).

Toolchain

• Gradle 8.9 → 8.14.3 (wrapper regenerated: jar, scripts, properties)
• Android Gradle Plugin 8.7.2 → 8.13.0
• Kotlin 1.9.24 → 1.9.25 (stays on 1.9.x) with Compose compiler 1.5.14 → 1.5.15 (matching version)
• compileSdk / targetSdk 35 → 36
• minSdk stays 26 (already above 24)

Dependencies

• androidx core-ktx 1.15.0 → 1.16.0, appcompat 1.7.0 → 1.7.1, lifecycle-runtime-ktx 2.8.7 → 2.9.4, activity-compose 1.9.3 → 1.10.1, window 1.3.0 → 1.4.0
• Material 1.12.0 → 1.13.0, CameraX 1.4.0 → 1.4.2, zxing 3.4.1 → 3.5.3, gson 2.10.1 → 2.13.2
• Test: coroutines 1.6.2 → 1.9.0; androidTest ext junit 1.1.3 → 1.3.0, espresso 3.4.0 → 3.7.0, compose ui-test-junit4 / ui-tooling 1.0.5 → 1.7.5

Deliberately held back

• Compose itself stays on 1.7.x (newer needs the Kotlin 2 compiler plugin)
• Mockito stays at 4.3.0 / mockito-kotlin 4.0.0: Mockito 5 cannot mock java.nio.ByteBuffer on JDK 21 (used by ScanCodeTests)

Compatibility. Dependency versions are limited to releases that require at most compileSdk 35 (checked against each resolved AAR's minCompileSdk) and no newer AGP than 8.7.2, so MABS 11.2 (compileSdk 35, AGP 8.7.2, Kotlin 1.9.24) keeps working. The library is built with compileSdk 36 and its AAR declares minCompileSdk=1. The library stays on Kotlin 1.9.x so it is readable by the MABS 11.2 / 12.1 compiler (1.9.24). minSdk is never raised above 24 (a library that was already higher keeps its existing value, as RMET-5348 specifies); MABS builds use minSdk 28.

Sibling PRs for RMET-5348:

• fileviewer: chore: update dependencies and build tooling ionic-team/ion-android-fileviewer#6
• filesystem: chore: update dependencies and build tooling ionic-team/ion-android-filesystem#13
• filetransfer: chore: update dependencies and build tooling ionic-team/ion-android-filetransfer#15
• geolocation: chore: update dependencies and build tooling ionic-team/ion-android-geolocation#16
• camera: chore: update dependencies and build tooling ionic-team/ion-android-camera#22
• inappbrowser: chore: update dependencies and build tooling OSInAppBrowserLib-Android#66
• barcode: chore: update dependencies and build tooling #60
• healthfitness: chore: update dependencies and build tooling ionic-team/ion-android-healthfitness#1

Type of changes

• Fix (non-breaking change which fixes an issue)
• Feature (non-breaking change which adds functionality)
• Refactor (cosmetic changes)
• Breaking change (change that would cause existing functionality to not work as expected)

Tests

Assemble (debug and release) and lint pass. ScanCodeTests (34/34) fails under JDK 21 (Mockito cannot mock ByteBuffer) with and without these changes, identically to unmodified main; no JDK 17 was available locally, so please rely on CI here.

Consumer builds, run against this branch published to a local Maven repository (all eight libraries together; fresh dependency installs; each plugin on its main, Capacitor 9 on next):

• Capacitor plugin capacitor-barcode-scanner and Cordova plugin cordova-outsystems-barcode included.
• Capacitor 8.3.5 example apps (main): 8/8 plugins build (barcode on 8.3.4). Capacitor 9.0.0-beta.0 (next): 7/8 build; capacitor-health-fitness next fails in its own example app identically with the released library (a fresh Capacitor 9 app with the packed plugin builds).
• Cordova app with all eight OutSystems plugins on MABS-like toolchains, debug and release both build: MABS 11.2 (Gradle 8.11.1, AGP 8.7.2, Kotlin 1.9.24, SDK 35), MABS 12.1 (Gradle 8.14.3, AGP 8.13.0, Kotlin 1.9.24, SDK 36), MABS 13 (OutSystems cordova-android 15.1.0+1.1.0, Gradle 9.5.1, AGP 9.2.1, Kotlin 2.2.20, SDK 37). R8-minified release builds also pass on all three, with the health-fitness keep rules applied.
• Real MABS builds, from per-plugin test branches that bundle this branch's library build (no Maven publish): all Cordova plugins on MABS 11.2, 12.1 and 13, and all Capacitor plugins on MABS 12.1 and 13. Every build succeeded.
• This is build-level validation; no claim is made here about on-device behavior.
• The Cordova plugins reference most libraries as @aar, so they do not pick up these libraries' dependency bumps and keep their own pinned versions.
• While building the Cordova Barcode plugin on its own for MABS, it failed to compile (Unresolved reference gson in OSBarcode.kt): the plugin never declared Gson and relied on another plugin providing it. This is pre-existing (reproduced on unmodified main with the released library) and is fixed in cordova-outsystems-barcode; no change is needed in this library.

Screenshots (if appropriate)

Checklist

• CHANGELOG.md file is correctly updated
• Changes require an update to the documentation
  • Documentation has been updated accordingly

[wiz-code-outsystems]

Wiz Scan Summary

⚠️ Many findings detected

Many findings were detected, but only a subset of the findings are displayed inline due to API constraints. To view all findings inline, please click here.

Scanner	Findings
Vulnerabilities	26  27  2
Sensitive Data	-
Secrets	-
IaC Misconfigurations	-
SAST Findings	-
Software Management Findings	-
Total	26  27  2

View scan details in Wiz

To detect these findings earlier in the dev lifecycle, try the Wiz Code extension for VS Code, JetBrains, or Visual Studio.

Pull Request Developer Guidance

Questions? See the Wiz FAQ.

Please contact the Security Office if you encounter issues with Wiz pull request scanning.