Merge branch 'main' into claude/persistent-ad-settings-compartments

Author: HereLiesAz

.github/workflows/dependency-graph.yml

@@ -0,0 +1,42 @@
+name: Dependency Graph
+
+# Submit ONLY the app's shipped (release runtime) dependencies to GitHub's dependency graph, so
+# Dependabot scans what actually ends up in the APK/AAB. Gradle's automatic dependency submission
+# resolves *every* classpath — including the build-tooling / plugin classpath — which drags in
+# transitive libraries (e.g. Netty via the Android Gradle Plugin) that are never shipped and only
+# create false-positive alerts. Scoping to `releaseRuntimeClasspath` excludes those.
+#
+# IMPORTANT: turn OFF the repository's "Automatic dependency submission" setting
+# (Settings -> Code security -> Dependency graph) so this scoped submission is the only one;
+# otherwise the automatic one keeps re-adding the build-tooling dependencies.
+on:
+  push:
+    branches: [ "main" ]
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+concurrency:
+  group: dependency-graph-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  dependency-submission:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up JDK 21
+        uses: actions/setup-java@v4
+        with:
+          java-version: '21'
+          distribution: 'temurin'
+
+      - name: Submit dependency graph
+        uses: gradle/actions/dependency-submission@v4
+        env:
+          # Report only the shipped release runtime classpaths; skip buildscript / plugin classpaths
+          # (named "classpath") so build-time-only transitives aren't flagged by Dependabot.
+          DEPENDENCY_GRAPH_INCLUDE_CONFIGURATIONS: "^releaseRuntimeClasspath$"

app/build.gradle.kts

@@ -205,8 +205,8 @@ configurations.all {
                 // Netty artifacts are versioned together; force the whole family (except the
                 // separately-versioned tcnative natives) to the latest 4.1 security release.
                 g == "io.netty" && !n.startsWith("netty-tcnative") -> {
-                    useVersion("4.1.133.Final")
-                    because("Security fixes: CVE-2025-67735, CVE-2026-42583, CVE-2026-42587, et al.")
+                    useVersion("4.1.121.Final")
+                    because("Build-tooling transitive only (never shipped); pin Netty to the latest 4.1.x security release")
                 }
                 g == "org.bouncycastle" && n.endsWith("-jdk18on") -> {
                     useVersion("1.84")

build.gradle.kts

@@ -15,8 +15,8 @@ buildscript {
                     because("Security fixes: CVE-2023-2976 & CVE-2020-8908 (insecure temp-dir use / info disclosure)")
                 }
                 g == "io.netty" && !n.startsWith("netty-tcnative") -> {
-                    useVersion("4.1.133.Final")
-                    because("Security fixes: CVE-2025-67735, CVE-2026-42583, CVE-2026-42587, et al.")
+                    useVersion("4.1.121.Final")
+                    because("Build-tooling transitive only (never shipped); pin Netty to the latest 4.1.x security release")
                 }
                 g == "org.bouncycastle" && n.endsWith("-jdk18on") -> {
                     useVersion("1.84")
@@ -74,7 +74,7 @@ subprojects {
                     useVersion("3.25.5"); because("Security fix")
                 }
                 g == "io.netty" && !n.startsWith("netty-tcnative") -> {
-                    useVersion("4.1.133.Final"); because("Security fixes")
+                    useVersion("4.1.121.Final"); because("Latest 4.1.x security release")
                 }
                 g == "org.bouncycastle" && n.endsWith("-jdk18on") -> {
                     useVersion("1.84"); because("Security fixes")