Batch-upgrade dependencies: 4 of ~14 safely bumped, rest blocked on compileSdk

DataStore, security-crypto (out of alpha), and the two androidx.test
libs upgraded cleanly. Everything else in the Compose/Activity/
Navigation/Lifecycle/Room/WorkManager family's current releases
requires compileSdk 35+/AGP 8.6+ (this project is on AGP 8.3.2/
compileSdk 34) -- reverted those to original versions rather than
force a much bigger AGP/compileSdk upgrade into what was scoped as a
routine freshness pass. Documented as its own BACKLOG item, along
with the EncryptedSharedPreferences/MasterKey deprecation the
security-crypto bump surfaced.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017GMEkHeqKz6FLkmizowBTK

1 files changed, 25 insertions, 0 deletions

diff --git a/BACKLOG.md b/BACKLOG.md
index 171f2af..2918517 100644
--- a/BACKLOG.md
+++ b/BACKLOG.md
@@ -134,3 +134,28 @@ submission endpoint exists anywhere in the code. Confirmed intentional:
 there's no backend to submit to (single-user personal app), and the real
 destination is pasting it straight into a message during the normal
 hands-on-testing workflow. Not a gap to fill.
+
+## AGP / compileSdk upgrade (not yet built)
+
+**Motivation:** a routine dependency-freshness pass found that essentially
+the entire Compose/Activity/Navigation/Lifecycle/Room/WorkManager family's
+current releases now require `compileSdk 35`+ and AGP `8.6.0`+ (several
+need AGP `9.1.0`). This project is pinned at AGP `8.3.2` / `compileSdk 34`.
+Only 4 of the ~14 outdated dependencies found could be safely bumped in
+place (DataStore, security-crypto out of alpha, and the two androidx.test
+libs) -- everything else was reverted back to its original version after
+hitting AAR-metadata errors. This gap will only widen as androidx keeps
+releasing.
+
+**Rough shape (not yet built):** bump AGP (and correspondingly Gradle,
+since AGP 8.6+ needs a newer Gradle than the current 8.6 wrapper) and
+`compileSdk`/`targetSdk`, then re-run the dependency-freshness pass. A
+real change, not a version-number edit -- test on a real device
+afterward, not just a clean build, since a `compileSdk`/`targetSdk` jump
+can change runtime behavior (permission dialogs, back-gesture handling,
+etc.), independent of whatever library versions ride along with it.
+
+**Also surfaced by the same pass:** bumping `security-crypto` out of alpha
+(1.1.0-alpha06 -> 1.1.0, done) made `EncryptedSharedPreferences`/`MasterKey`
+(used in `Settings.kt` for the Stash API key) show up as deprecated. Not
+migrated yet -- the replacement API wasn't investigated this round.