Batch-upgrade dependencies: 4 of ~14 safely bumped, rest blocked on compileSdk

DataStore, security-crypto (out of alpha), and the two androidx.test
libs upgraded cleanly. Everything else in the Compose/Activity/
Navigation/Lifecycle/Room/WorkManager family's current releases
requires compileSdk 35+/AGP 8.6+ (this project is on AGP 8.3.2/
compileSdk 34) -- reverted those to original versions rather than
force a much bigger AGP/compileSdk upgrade into what was scoped as a
routine freshness pass. Documented as its own BACKLOG item, along
with the EncryptedSharedPreferences/MasterKey deprecation the
security-crypto bump surfaced.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017GMEkHeqKz6FLkmizowBTK

2 files changed, 29 insertions, 4 deletions

diff --git a/BACKLOG.md b/BACKLOG.md
index 171f2af..2918517 100644
--- a/BACKLOG.md
+++ b/BACKLOG.md
@@ -134,3 +134,28 @@ submission endpoint exists anywhere in the code. Confirmed intentional:
 there's no backend to submit to (single-user personal app), and the real
 destination is pasting it straight into a message during the normal
 hands-on-testing workflow. Not a gap to fill.
+
+## AGP / compileSdk upgrade (not yet built)
+
+**Motivation:** a routine dependency-freshness pass found that essentially
+the entire Compose/Activity/Navigation/Lifecycle/Room/WorkManager family's
+current releases now require `compileSdk 35`+ and AGP `8.6.0`+ (several
+need AGP `9.1.0`). This project is pinned at AGP `8.3.2` / `compileSdk 34`.
+Only 4 of the ~14 outdated dependencies found could be safely bumped in
+place (DataStore, security-crypto out of alpha, and the two androidx.test
+libs) -- everything else was reverted back to its original version after
+hitting AAR-metadata errors. This gap will only widen as androidx keeps
+releasing.
+
+**Rough shape (not yet built):** bump AGP (and correspondingly Gradle,
+since AGP 8.6+ needs a newer Gradle than the current 8.6 wrapper) and
+`compileSdk`/`targetSdk`, then re-run the dependency-freshness pass. A
+real change, not a version-number edit -- test on a real device
+afterward, not just a clean build, since a `compileSdk`/`targetSdk` jump
+can change runtime behavior (permission dialogs, back-gesture handling,
+etc.), independent of whatever library versions ride along with it.
+
+**Also surfaced by the same pass:** bumping `security-crypto` out of alpha
+(1.1.0-alpha06 -> 1.1.0, done) made `EncryptedSharedPreferences`/`MasterKey`
+(used in `Settings.kt` for the Stash API key) show up as deprecated. Not
+migrated yet -- the replacement API wasn't investigated this round.
diff --git a/app/build.gradle.kts b/app/build.gradle.kts
index 42bdbed..dd1cddd 100644
--- a/app/build.gradle.kts
+++ b/app/build.gradle.kts
@@ -63,8 +63,8 @@ dependencies {
     ksp("androidx.room:room-compiler:2.6.1")
 
     implementation("androidx.work:work-runtime-ktx:2.9.0")
-    implementation("androidx.datastore:datastore-preferences:1.1.1")
-    implementation("androidx.security:security-crypto:1.1.0-alpha06")
+    implementation("androidx.datastore:datastore-preferences:1.2.1")
+    implementation("androidx.security:security-crypto:1.1.0")
 
     implementation("com.squareup.okhttp3:okhttp:4.12.0")
     implementation("org.jetbrains.kotlinx:kotlinx-serialization-json:1.6.3")
@@ -80,8 +80,8 @@ dependencies {
     // extraction-pipeline regression tests can't be plain JVM unit tests. MockWebServer serves
     // fixture HTML over real http:// -- ReaderExtractor's WebView has allowFileAccess = false
     // (deliberately, see its own comments), so file:// fixtures wouldn't load.
-    androidTestImplementation("androidx.test.ext:junit:1.2.1")
-    androidTestImplementation("androidx.test:runner:1.6.2")
+    androidTestImplementation("androidx.test.ext:junit:1.3.0")
+    androidTestImplementation("androidx.test:runner:1.7.0")
     androidTestImplementation("org.jetbrains.kotlinx:kotlinx-coroutines-test:1.8.0")
     androidTestImplementation("com.squareup.okhttp3:mockwebserver:4.12.0")
 }