Build: AGP 9, Kotlin 2.4, compileSdk 37 (Agenda Tech toolchain)

.github/dependabot.yml

@@ -29,30 +29,11 @@ updates:
         patterns:
           - "org.junit*"
     ignore:
-      # AGP 9 is a migration (Kotlin moves into AGP), done by hand, not a version bump.
-      - dependency-name: "com.android.application"
-        update-types: ["version-update:semver-major"]
-      - dependency-name: "com.android.tools.build:gradle"
-        update-types: ["version-update:semver-major"]
-      # Hilt 2.58+ requires AGP 9 (gradle/libs.versions.toml).
-      - dependency-name: "com.google.dagger*"
-        versions: [">= 2.58"]
-      # These require AGP 9.1 and compileSdk 37 (measured on PR #14, 2026-10-05): Compose 1.12, Navigation
-      # 2.10, Hilt Navigation 1.4. core-ktx is capped for the same reason (gradle/libs.versions.toml).
-      # They come with the AGP 9 migration, as on Agenda Tech, not one bump at a time.
-      - dependency-name: "androidx.compose:compose-bom"
-        versions: [">= 2026.09.00"]
-      - dependency-name: "androidx.navigation:*"
-        versions: [">= 2.10.0"]
-      - dependency-name: "androidx.hilt:*"
-        versions: [">= 1.4.0"]
-      - dependency-name: "androidx.core:*"
-        versions: [">= 1.19.0"]
-      # Kotlin 2.4 goes with the AGP 9 migration too (2.4.10 fails the build here, PR #15). Beyond that,
-      # CodeQL 2.27 refuses Kotlin 2.4.20+ ("currently supports versions below 2.4.20", measured on
-      # Agenda Tech).
+      # Kotlin 2.4.20+: CodeQL 2.27 refuses to compile it ("currently supports versions below 2.4.20",
+      # measured on Agenda Tech). A bump PR would fail on every run; the root build.gradle.kts also pins
+      # the compiler with `strictly`. Remove once a CodeQL release supports it.
       - dependency-name: "org.jetbrains.kotlin*"
-        versions: [">= 2.4.0"]
+        versions: [">= 2.4.20"]
       # JUnit majors stay a deliberate step (JUnit 6 needs Kotlin 2.2+ and drops deprecated APIs). Minor
       # bumps pass since the platform launcher is declared through the BOM (gradle/libs.versions.toml):
       # before that, ANY version but 5.11.3 discovered no test (PRs #16 and #21).

README.fr.md

@@ -146,8 +146,8 @@ Pas de Play Store : aucun compte n'est nécessaire pour installer.
 
 ## Construction locale
 
-Prérequis : JDK 17, SDK Android 36, NDK `27.0.12077973` et CMake 3.22.1 (épinglés dans
-`app/build.gradle.kts`). Gradle 8.13 arrive avec le wrapper.
+Prérequis : JDK 17, SDK Android 37, NDK `27.0.12077973` et CMake 3.22.1 (épinglés dans
+`app/build.gradle.kts`). Gradle 9.8.1 arrive avec le wrapper.
 
 ```bash
 ./gradlew testDebugUnitTest lintDebug
@@ -165,7 +165,7 @@ et l'APK universel `versionCode × 10`.
 
 ## Technique
 
-- Kotlin 2.3, Jetpack Compose (Material 3), Hilt, Room sur **SQLCipher** 4.16, DataStore
+- Kotlin 2.4, Jetpack Compose (Material 3), Hilt, Room sur **SQLCipher** 4.16, DataStore
 - Bouncy Castle (Argon2id), Keystore Android, AES-256-GCM de la plateforme
 - `org.jetbrains:markdown` (aperçu), whisper.cpp par JNI (dictée)
 - **Aucune bibliothèque réseau**

README.md

@@ -140,8 +140,8 @@ No Play Store: no account is needed to install.
 
 ## Local build
 
-Requirements: JDK 17, Android SDK 36, NDK `27.0.12077973` and CMake 3.22.1 (pinned in
-`app/build.gradle.kts`). Gradle 8.13 comes with the wrapper.
+Requirements: JDK 17, Android SDK 37, NDK `27.0.12077973` and CMake 3.22.1 (pinned in
+`app/build.gradle.kts`). Gradle 9.8.1 comes with the wrapper.
 
 ```bash
 ./gradlew testDebugUnitTest lintDebug
@@ -158,7 +158,7 @@ and the universal APK `versionCode × 10`.
 
 ## Stack
 
-- Kotlin 2.3, Jetpack Compose (Material 3), Hilt, Room on **SQLCipher** 4.16, DataStore
+- Kotlin 2.4, Jetpack Compose (Material 3), Hilt, Room on **SQLCipher** 4.16, DataStore
 - Bouncy Castle (Argon2id), Android Keystore, AES-256-GCM from the platform
 - `org.jetbrains:markdown` (preview), whisper.cpp through JNI (dictation)
 - **No network library**

app/build.gradle.kts

@@ -4,7 +4,7 @@ import java.util.Properties
 
 plugins {
     alias(libs.plugins.android.application)
-    alias(libs.plugins.kotlin.android)
+    // No `org.jetbrains.kotlin.android`: AGP 9 compiles Kotlin itself.
     alias(libs.plugins.kotlin.compose)
     alias(libs.plugins.ksp)
     alias(libs.plugins.hilt)
@@ -69,7 +69,9 @@ android {
     // classes, et donc les alias Keystore que `flutter_secure_storage` a dérivés du nom de paquet.
     // Cf. docs/01-DECISIONS.md D-007.
     namespace = "com.filestech.notes_tech"
-    compileSdk = 36
+    // compileSdk 37 as in Agenda Tech and App Manager Tech: the AndroidX releases built for AGP 9
+    // require it. targetSdk stays 36 (below), so the app's behaviour on the device does not change.
+    compileSdk = 37
 
     defaultConfig {
         // ⚠️ PAS `com.filestech.notes_tech` par défaut — voir le bloc « prise de place » ci-dessus.

build.gradle.kts

@@ -1,6 +1,22 @@
+// The Kotlin compiler version, as a real cap. With AGP 9 the Kotlin Gradle Plugin (KGP) is a
+// dependency of AGP itself, and Gradle keeps the HIGHEST version requested: the catalog's `kotlin`
+// entry reaches the compiler only through the Compose plugin. A future AGP asking for 2.4.20+ would
+// raise the compiler silently past what CodeQL accepts. `strictly` holds it at the catalog's version
+// whatever is requested: Gradle downgrades every higher request to it (measured on App Manager Tech,
+// 2026-10-08). Raising Kotlin is therefore always a deliberate edit of the catalog.
+buildscript {
+    dependencies {
+        constraints {
+            classpath("org.jetbrains.kotlin:kotlin-gradle-plugin") {
+                version { strictly(libs.versions.kotlin.get()) }
+                because("CodeQL 2.27 refuses Kotlin 2.4.20+; the compiler must be the catalog's version")
+            }
+        }
+    }
+}
+
 plugins {
     alias(libs.plugins.android.application) apply false
-    alias(libs.plugins.kotlin.android) apply false
     alias(libs.plugins.kotlin.compose) apply false
     alias(libs.plugins.ksp) apply false
     alias(libs.plugins.hilt) apply false

gradle.properties

@@ -23,5 +23,16 @@ kotlin.incremental=true
 ## Démon du compilateur Kotlin — sa propre JVM, il ne partage pas celle de Gradle.
 kotlin.daemon.jvmargs=-Xmx1536m -XX:MaxMetaspaceSize=512m -XX:+UseParallelGC -Dfile.encoding=UTF-8
 
-## KSP 2 — requis par AGP 8.13+.
+## KSP 2 — required since AGP 8.13, and the only KSP that runs with AGP 9.
 ksp.useKSP2=true
+
+## Lint in its own process, not in the Gradle daemon (AGP 9 migration, 2026-10-10).
+##
+## Measured on the first AGP 9.4.1 gate: `lintAnalyzeDebugUnitTest` and `lintAnalyzeDebugAndroidTest`
+## both died on an internal error of lint's Kotlin analyser ("Error while resolving FirRegularClassImpl
+## from RAW_FIR to COMPILER_REQUIRED_ANNOTATIONS", "this is a bug in lint"), while
+## `kspDebugAndroidTestKotlin` was running in the same JVM. Lint alone, or after KSP, passed on the same
+## sources: a race between two users of the Kotlin compiler inside one process, not a finding. Out of
+## process, lint shares nothing with KSP or with its other analyses, so the order the parallel build
+## happens to pick no longer decides whether CI is red.
+android.experimental.runLintInProcess=false

gradle/libs.versions.toml

@@ -1,17 +1,19 @@
 [versions]
-# Chaîne de build — alignée sur Agenda Tech et SMS Tech (AGP 8.13.x / Kotlin 2.3.20 / KSP 2.3.9 / JDK 17).
-agp = "8.13.2"
-kotlin = "2.3.21"
+# Build toolchain — the one Agenda Tech and App Manager Tech run (AGP 9.4.1 / Kotlin 2.4.10 / KSP 2.3.12
+# / JDK 17). AGP 9 compiles Kotlin itself: there is no `org.jetbrains.kotlin.android` plugin any more.
+agp = "9.4.1"
+# Capped below 2.4.20: CodeQL 2.27 refuses to compile from there ("currently supports versions below
+# 2.4.20", measured on Agenda Tech). This is the EXACT compiler version: the root build.gradle.kts pins
+# the Kotlin Gradle Plugin to it with `strictly`, since AGP 9 would otherwise bring its own.
+kotlin = "2.4.10"
 ksp = "2.3.12"
 
-# AndroidX / Compose
-compose-bom = "2026.06.00"
-# core-ktx et lifecycle sont plafonnés au dernier palier compatible AGP 8.13 / compileSdk 36,
-# comme dans les deux autres projets Kotlin du portefeuille. Ne pas monter isolément.
-core-ktx = "1.18.0"
+# AndroidX / Compose — the releases built for AGP 9 and compileSdk 37, as in Agenda Tech.
+compose-bom = "2026.09.00"
+core-ktx = "1.19.1"
 activity-compose = "1.13.0"
-lifecycle = "2.10.0"
-navigation-compose = "2.9.8"
+lifecycle = "2.11.0"
+navigation-compose = "2.10.2"
 room = "2.8.5"
 datastore = "1.1.1"
 splashscreen = "1.2.0"
@@ -20,9 +22,9 @@ splashscreen = "1.2.0"
 # (`authenticate` after `onSaveInstanceState` gives up in silence; see `BiometricPrompts`).
 biometric = "1.1.0"
 
-# Hilt — plafonné à la dernière version compatible AGP 8.x (Hilt 2.58+ exige AGP 9).
-hilt = "2.57.2"
-hilt-navigation-compose = "1.3.0"
+# Hilt — 2.58+ requires AGP 9. Same versions as Agenda Tech and App Manager Tech.
+hilt = "2.60.1"
+hilt-navigation-compose = "1.4.0"
 
 coroutines = "1.11.0"
 
@@ -128,7 +130,6 @@ detekt-formatting = { module = "io.gitlab.arturbosch.detekt:detekt-formatting",
 
 [plugins]
 android-application = { id = "com.android.application", version.ref = "agp" }
-kotlin-android = { id = "org.jetbrains.kotlin.android", version.ref = "kotlin" }
 kotlin-compose = { id = "org.jetbrains.kotlin.plugin.compose", version.ref = "kotlin" }
 ksp = { id = "com.google.devtools.ksp", version.ref = "ksp" }
 hilt = { id = "com.google.dagger.hilt.android", version.ref = "hilt" }

gradle/wrapper/gradle-wrapper.properties

@@ -1,7 +1,10 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.13-bin.zip
+distributionSha256Sum=dce76f55f8e251a3a1f130eb120f30b3d271de2b76c9b0729d316b5a1b6dc01f
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.8.1-bin.zip
 networkTimeout=10000
+retries=0
+retryBackOffMs=500
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists