fix(security): clear remaining Dependabot alerts (Kotlin plugin, httpclient, commons-lang3)

[mattinannt]

What & why

7 Dependabot alerts are open. Status of each:

Alert	Package	Severity	Fix	Status
#56, #57	jackson-databind	High	2.22.3	Already fixed on main by #95 — the alerts should close once GitHub re-scans the dependency graph (the SBOM already lists only 2.22.3)
#58, #59	jackson-core	High	2.22.3	Same as above
#48	kotlin-gradle-plugin	Moderate	2.4.20-Beta1	This PR
#54	commons-lang3	Moderate	3.18.0	This PR
#60	httpclient	Moderate	4.5.13	This PR

All of these are build-toolchain transitives; none reaches the published AAR.

Changes

• kotlin-gradle-plugin — AGP 9.4.1 still resolves 2.2.10 on the root buildscript classpath. Added a constraint to libs.versions.kotlin (2.4.20), the version :android already uses.
• httpclient / commons-lang3 — the Android lint tool (androidLintTool) resolved httpclient 4.5.6 (via httpmime) and commons-lang3 3.16.0 (via commons-compress). Added per-module floors in android/build.gradle.kts; the existing floors are per group, and org.apache.commons also holds commons-compress and commons-codec, which shouldn't be moved.
• New httpclient entry in gradle/libs.versions.toml, plus comment updates.

Verification

• buildEnvironment and :android:dependencies --configuration androidLintTool now resolve kotlin-gradle-plugin 2.2.10 -> 2.4.20, httpclient 4.5.6 -> 4.5.14 and commons-lang3 3.16.0 -> 3.21.0.
• A full assembleRelease / unit test run was not possible locally (no Android SDK in my environment), so that is left to CI.
• Not tested here: the Dokka / Maven publish path.

🤖 Generated with Claude Code

https://claude.ai/code/session_018LexopwXbMBrV7EjBEdWu8

---

Generated by Claude Code

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 7aabe750-dae4-4388-a45b-1f5bd14eb562

---

📥 Commits

Reviewing files that changed from the base of the PR and between f5a64b5 and 7f630be.

---

📒 Files selected for processing (3)

• android/build.gradle.kts
• build.gradle.kts
• gradle/libs.versions.toml

---

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

---

Walkthrough

The buildscript classpath now constrains the Kotlin Gradle plugin to the version in the version catalog. Android dependency resolution now checks module-specific floors for Android lint’s httpclient and commons-lang3 dependencies before falling back to existing group-level floors. The version catalog adds an httpclient floor of 4.5.14.

Priority: ➖ Normal

Merge Risk: ⚪ Minimal · up to 7f630

The Kotlin plugin resolves to 2.4.20, and Android lint’s vulnerable dependency requests are covered by the module-specific floors. No identified issue prevents merging.

Pre-merge checks | 4 | 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 2 files. (1 skipped: 1 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check		The title clearly identifies the main security change: updating the Kotlin Gradle plugin, httpclient, and commons-lang3 dependency floors to address Dependabot alerts.
Description check		The description directly explains the Dependabot alerts, the dependency-floor changes, affected configurations, and verification results. It is related to the changeset.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

---

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 2 files. (1 skipped: 1 unsupported.)

---

• Fix all pre-merge checks with AI

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud