[alexgerardojacinto]

Description

Part of RMET-5348: update the native Android libraries' build tooling and dependencies, keeping a single major version for all consumers (MABS 11.2 / 12.1 / 13, Capacitor 8 and 9).

Toolchain

• Gradle: already 8.14.3 (wrapper files regenerated)
• Android Gradle Plugin 8.11.1 → 8.13.0
• Kotlin: already 1.9.25
• compileSdk / targetSdk: already 36
• minSdk stays 26 (already above 24)

Dependencies

• androidx core-ktx 1.15.0 → 1.16.0, lifecycle-runtime-ktx 2.8.7 → 2.9.4, appcompat 1.7.0 → 1.7.1, webkit 1.12.1 → 1.14.0, constraintlayout 2.2.0 → 2.2.1, activity-ktx 1.9.3 → 1.10.1
• kotlinx-coroutines (core, android, test) → 1.9.0 (was 1.6.4 / 1.7.3), gson 2.10.1 → 2.13.2
• Test: robolectric 4.12.2 → 4.16.1, mockito-core 5.12.0 → 5.23.0, mockk 1.13.10 → 1.13.17, androidx.test:core 1.6.1 → 1.7.0

Deliberately held back

• androidx.browser stays at 1.8.0 (1.9.0 needs compileSdk 36)
• coroutines capped at 1.9.0 (newer versions ship Kotlin 2.1 metadata that Kotlin 1.9 consumers cannot read)

Compatibility. Dependency versions are limited to releases that require at most compileSdk 35 (checked against each resolved AAR's minCompileSdk) and no newer AGP than 8.7.2, so MABS 11.2 (compileSdk 35, AGP 8.7.2, Kotlin 1.9.24) keeps working. The library is built with compileSdk 36 and its AAR declares minCompileSdk=1. The library stays on Kotlin 1.9.x so it is readable by the MABS 11.2 / 12.1 compiler (1.9.24). minSdk is never raised above 24 (a library that was already higher keeps its existing value, as RMET-5348 specifies); MABS builds use minSdk 28.

Sibling PRs for RMET-5348:

• fileviewer: chore: update dependencies and build tooling ionic-team/ion-android-fileviewer#6
• filesystem: chore: update dependencies and build tooling ionic-team/ion-android-filesystem#13
• filetransfer: chore: update dependencies and build tooling (RMET-5348) ionic-team/ion-android-filetransfer#15
• geolocation: chore: update dependencies and build tooling (RMET-5348) ionic-team/ion-android-geolocation#16
• camera: chore: update dependencies and build tooling (RMET-5348) ionic-team/ion-android-camera#22
• inappbrowser: chore: update dependencies and build tooling (RMET-5348) #66
• barcode: chore: update dependencies and build tooling (RMET-5348) OSBarcodeLib-Android#60
• healthfitness: chore: update dependencies and build tooling (RMET-5348) ionic-team/ion-android-healthfitness#1

Type of changes

• Fix (non-breaking change which fixes an issue)
• Feature (non-breaking change which adds functionality)
• Refactor (cosmetic changes)
• Breaking change (change that would cause existing functionality to not work as expected)

Tests

./gradlew clean build (unit tests + lint) passes.

Consumer builds, run against this branch published to a local Maven repository (all eight libraries together; fresh dependency installs; each plugin on its main, Capacitor 9 on next):

• Capacitor plugin capacitor-os-inappbrowser and Cordova plugin cordova-outsystems-inappbrowser included.
• Capacitor 8.3.5 example apps (main): 8/8 plugins build (barcode on 8.3.4). Capacitor 9.0.0-beta.0 (next): 7/8 build; capacitor-health-fitness next is not Capacitor 9-ready and fails identically with the released library.
• Cordova app with all eight OutSystems plugins on MABS-like toolchains, debug and release both build: MABS 11.2 (Gradle 8.11.1, AGP 8.7.2, Kotlin 1.9.24, SDK 35), MABS 12.1 (Gradle 8.14.3, AGP 8.13.0, Kotlin 1.9.24, SDK 36), MABS 13 (OutSystems cordova-android 15.1.0+1.1.0, Gradle 9.5.1, AGP 9.2.1, Kotlin 2.2.20, SDK 37). R8-minified release builds also pass on all three, with the health-fitness keep rules applied.
• Not run on a device/emulator, and MABS itself was not used (toolchain numbers replicated in a Cordova/Capacitor test app). The Cordova plugins reference most libraries as @aar, so they do not pick up these libraries' dependency bumps and keep their own pinned versions.

Screenshots (if appropriate)

Checklist

• CHANGELOG.md file is correctly updated
• Changes require an update to the documentation
  • Documentation has been updated accordingly

[wiz-code-outsystems]

Wiz Scan Summary

⚠️ Many findings detected

Many findings were detected, but only a subset of the findings are displayed inline due to API constraints. To view all findings inline, please click here.

Scanner	Findings
Vulnerabilities	26  26  2
Sensitive Data	-
Secrets	-
IaC Misconfigurations	-
SAST Findings	-
Software Management Findings	-
Total	26  26  2

View scan details in Wiz

To detect these findings earlier in the dev lifecycle, try the Wiz Code extension for VS Code, JetBrains, or Visual Studio.

Pull Request Developer Guidance

Questions? See the Wiz FAQ.

Please contact the Security Office if you encounter issues with Wiz pull request scanning.