Merge pull request #2875 from square/py/dependency-refresh

Update dependencies and the build toolchain

Author: pyricau

.github/workflows/main.yml

@@ -13,18 +13,18 @@ jobs:
   validation:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: gradle/actions/wrapper-validation@48b5f213c81028ace310571dc5ec0fbbca0b2947 # v4
+      - uses: actions/checkout@v7
+      - uses: gradle/actions/wrapper-validation@0723195856401067f7a2779048b490ace7a47d7c # v5
 
   checks:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-java@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-java@v5
         with:
           java-version: 17
           distribution: 'zulu'
-      - uses: gradle/actions/setup-gradle@48b5f213c81028ace310571dc5ec0fbbca0b2947 # v4
+      - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       - name: Build project
         run: ./gradlew build --stacktrace
 
@@ -64,12 +64,12 @@ jobs:
           sudo udevadm control --reload-rules
           sudo udevadm trigger --name-match=kvm
           ls /dev/kvm
-      - uses: actions/checkout@v4
-      - uses: actions/setup-java@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-java@v5
         with:
           java-version: 17
           distribution: 'zulu'
-      - uses: gradle/actions/setup-gradle@48b5f213c81028ace310571dc5ec0fbbca0b2947 # v4
+      - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       # Create the AVD and boot it from scratch on every run, rather than restoring a cached
       # snapshot. android-emulator-runner decides the device is ready when `getprop
       # sys.boot_completed` returns 1 and then immediately sends `input keyevent 82` to dismiss the
@@ -115,7 +115,7 @@ jobs:
             pkill -9 -f "qemu-syste[m]" || true
       - name: Upload results
         if: ${{ always() }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: ${{ matrix.api-level }}-${{ matrix.arch }}-instrumentation-test-results
           path: |
@@ -127,12 +127,12 @@ jobs:
     needs: [ checks ]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-java@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-java@v5
         with:
           java-version: 17
           distribution: 'zulu'
-      - uses: gradle/actions/setup-gradle@48b5f213c81028ace310571dc5ec0fbbca0b2947 # v4
+      - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       - name: Deploy snapshot
         run: ./gradlew publish
         env:

.github/workflows/publish-release.yml

@@ -11,8 +11,8 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository == 'square/leakcanary'
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-java@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-java@v5
         with:
           java-version: 17
           distribution: 'zulu'

.github/workflows/stale.yaml

@@ -9,7 +9,7 @@ jobs:
     permissions:
       issues: write
     steps:
-      - uses: actions/stale@v5
+      - uses: actions/stale@v11
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           days-before-stale: 30

AGENTS.md

@@ -110,8 +110,9 @@ every diff. Refactors, internal cleanups and test-only changes usually don't nee
 - Test heap dumps are built with the `dump { }` DSL from `shark-hprof-test` (see `docs/dev-env.md`)
   rather than committed as binary fixtures. Never hand-assemble hprof bytes. For a large realistic
   dump, drive a real JVM via `HotSpotDiagnosticMXBean.dumpHeap`.
-- Tests use JUnit 4 and AssertJ. Note AssertJ is pinned at **3.9.1**, which predates a lot of the
-  assertions you may reach for — `hasSizeLessThanOrEqualTo` and friends don't exist.
+- Tests use JUnit 4 and AssertJ. Instrumentation tests depend on `libs.assertjCore.android` rather
+  than `libs.assertjCore`, because AssertJ 3.16 and up can't load on API 24 — the catalog comment
+  says why. So an assertion that a unit test can use may not compile in an instrumentation test.
 
 ## Scoped guides
 

build.gradle.kts

@@ -4,7 +4,6 @@ import com.android.build.api.dsl.LibraryExtension
 import com.android.build.api.variant.LibraryAndroidComponentsExtension
 import com.android.build.api.variant.ScopedArtifacts
 import com.vanniktech.maven.publish.MavenPublishBaseExtension
-import com.vanniktech.maven.publish.SonatypeHost
 import io.gitlab.arturbosch.detekt.extensions.DetektExtension
 import java.net.URI
 import org.gradle.api.tasks.testing.logging.TestExceptionFormat
@@ -202,7 +201,7 @@ val publicApiProjects = subprojects.filter {
 configure(publicApiProjects) {
   pluginManager.withPlugin("com.vanniktech.maven.publish") {
     extensions.configure<MavenPublishBaseExtension> {
-      publishToMavenCentral(SonatypeHost.CENTRAL_PORTAL, automaticRelease = true)
+      publishToMavenCentral(automaticRelease = true)
       signAllPublications()
     }
   }

docs/changelog.md

@@ -43,6 +43,7 @@ Releases before 2.8.1 predate these markers.
     * 🔀 `ShortestPathObjectNode.retainedIncrease` is now 0 until the third heap dump. Computing it needs a retained size for the previous heap dump, computed with the same metric while that heap dump was still open, and the first traversal has no growing objects to compute a retained size from. `ShortestPathObjectNode.retained` is still reported from the second heap dump on.
     * 🔨 The traversal doesn't keep a dominator for every object it visits anymore. Instead, the objects that stay reachable without going through a growing object are walked once at the end of the traversal, and only when there are growing objects to report.
 * ⚠️ [#2841](https://github.com/square/leakcanary/pull/2841) The deobfuscation Gradle plugin moved to the Android Gradle Plugin Variant API and now requires AGP 8.0 or newer. `leakCanary.filterObfuscatedVariants` receives a `com.android.build.api.variant.Variant` instead of the removed `BaseVariant`, the task that copies the mapping file is renamed from `leakCanaryCopyObfuscationMappingFor${VariantName}` to `copy${VariantName}LeakCanaryObfuscationMapping`, and `CopyObfuscationMappingFileTask` no longer exposes `mergeAssetsDirectory` or `leakCanaryAssetsOutputFile`. Applying the plugin to a variant that doesn't have minification enabled now fails when the task runs rather than when the project is configured.
+* 🔀 Curtains 1.2.4 → 1.2.5, which reports Compose popup windows as `POPUP_WINDOW` instead of `UNKNOWN`. `RootViewWatcher.WindowTypeFilter` doesn't expect popup windows to become weakly reachable when they're detached, because Android widgets keep detached popup instances around, so a Compose popup that stays in memory after being detached is no longer reported as a leak.
 
 ## Version 3.0 Alpha 9 (2026-06-25)
 

docs/releasing.md

@@ -24,10 +24,6 @@ python3 -m venv venv
 source venv/bin/activate
 pip3 install --requirement docs/requirements.txt
 ```
-* The Google Analytics key, required by `mkdocs` when deploying the docs. Add to your `~/.bashrc`:
-```bash
-export LEAKCANARY_GOOGLE_ANALYTICS_KEY="UA-142834539-1"
-```
 
 ### Milestone management aliases (optional helpers)
 

docs/requirements.txt

@@ -1,3 +1,3 @@
-mkdocs==1.4.2
-mkdocs-material==9.1.3
-mkdocs-markdownextradata-plugin==0.2.5
+mkdocs==1.6.1
+mkdocs-material==9.7.7
+mkdocs-markdownextradata-plugin==0.2.6

gradle/libs.versions.toml

@@ -13,30 +13,35 @@
 # limitations under the License.
 
 [versions]
-# We would like to use Kotlin recent language features but keep Kotlin 1.3 library APIs
-# The benefit is that depending clients do not have to upgrade to Kotlin 1.4
-compose = "1.4.3"
-kotlin = "2.4.0"
+compose = "1.11.4"
+# androidx.lifecycle 2.11.0 requires compiling against the Android 37 SDK
+lifecycle = "2.10.0"
+kotlin = "2.4.10"
+# Exposed transitively by shark, avoid increasing
 coroutines = "1.7.3"
-androidXTest = "1.5.0"
-androidXJunit = "1.1.5"
+androidXTest = "1.7.0"
+androidXJunit = "1.3.0"
+# Exposed transitively by leakcanary-android-process, avoid increasing
 workManager = "2.7.0"
 detekt = "1.23.8"
 dokka = "2.2.0"
 hilt = "2.60.1"
 sqldelight = "2.3.2"
 androidMinSdk = "24"
-androidCompileSdk = "35"
+androidCompileSdk = "36"
 
 [libraries]
+# Held at 9.2.1: the lint that AGP 9.3 bundles calls java.util.List.removeLast() from Java 8
+# bytecode, and that method only exists from Java 21, so every lint task dies with a
+# NoSuchMethodError on the JDK 17 this repo builds with.
 gradlePlugin-android = { module = "com.android.tools.build:gradle", version = "9.2.1" }
 gradlePlugin-kotlin = { module = "org.jetbrains.kotlin:kotlin-gradle-plugin", version.ref = "kotlin" }
 gradlePlugin-dokka = { module = "org.jetbrains.dokka:dokka-gradle-plugin", version.ref = "dokka" }
-gradlePlugin-mavenPublish = { module = "com.vanniktech:gradle-maven-publish-plugin", version = "0.32.0" }
+gradlePlugin-mavenPublish = { module = "com.vanniktech:gradle-maven-publish-plugin", version = "0.37.0" }
 gradlePlugin-detekt = { module = "io.gitlab.arturbosch.detekt:detekt-gradle-plugin", version.ref = "detekt" }
 gradlePlugin-sqldelight = { module = "app.cash.sqldelight:gradle-plugin", version.ref = "sqldelight" }
 gradlePlugin-hilt = { module = "com.google.dagger:hilt-android-gradle-plugin", version.ref = "hilt" }
-gradlePlugin-ksp = { module = "com.google.devtools.ksp:com.google.devtools.ksp.gradle.plugin", version = "2.3.9" }
+gradlePlugin-ksp = { module = "com.google.devtools.ksp:com.google.devtools.ksp.gradle.plugin", version = "2.3.10" }
 gradlePlugin-composeCompiler = { module = "org.jetbrains.kotlin.plugin.compose:org.jetbrains.kotlin.plugin.compose.gradle.plugin", version.ref = "kotlin" }
 # Used by the root build script to validate the ABI of Android library modules, see KT-83410.
 kotlin-abi-tools = { module = "org.jetbrains.kotlin:abi-tools", version.ref = "kotlin" }
@@ -60,35 +65,57 @@ androidX-fragment = { module = "androidx.fragment:fragment", version = "1.0.0" }
 # INITIALIZED lifecycle state, which LeakCanary has to account for. Instrumentation tests run
 # against a recent version so that they cover the behavior that apps actually run, while the
 # compileOnly dependency above stays at the lowest version LeakCanary supports.
-androidX-fragment-test = { module = "androidx.fragment:fragment", version = "1.8.6" }
+androidX-fragment-test = { module = "androidx.fragment:fragment", version = "1.8.9" }
 androidX-multidex = { module = "androidx.multidex:multidex", version = "2.0.1" }
 # Exposed transitively, avoid increasing
 androidX-startup = { module = "androidx.startup:startup-runtime", version = "1.0.0" }
-androidX-test-core = { module = "androidx.test:core", version = "1.5.0" }
-androidX-test-monitor = { module = "androidx.test:monitor", version = "1.6.1" }
+androidX-test-core = { module = "androidx.test:core", version = "1.7.0" }
+androidX-test-monitor = { module = "androidx.test:monitor", version = "1.8.0" }
 androidX-test-rules = { module = "androidx.test:rules", version.ref = "androidXTest" }
 # Exposed transitively, avoid increasing
 androidX-test-runner = { module = "androidx.test:runner", version = "1.5.2" }
-androidX-test-orchestrator = { module = "androidx.test:orchestrator", version = "1.5.0" }
-androidX-test-espresso = { module = "androidx.test.espresso:espresso-core", version = "3.5.1" }
+androidX-test-orchestrator = { module = "androidx.test:orchestrator", version = "1.6.1" }
+androidX-test-espresso = { module = "androidx.test.espresso:espresso-core", version = "3.7.0" }
 androidX-test-junit = { module = "androidx.test.ext:junit", version.ref = "androidXJunit" }
 androidX-test-junitKtx = { module = "androidx.test.ext:junit-ktx", version.ref = "androidXJunit" }
+# Exposed transitively by leakcanary-android-uiautomator, avoid increasing
 androidX-test-uiautomator = { module = "androidx.test.uiautomator:uiautomator", version = "2.2.0" }
 androidX-work-runtime = { module = "androidx.work:work-runtime", version.ref = "workManager" }
 androidX-work-multiprocess = { module = "androidx.work:work-multiprocess", version.ref = "workManager" }
+# Exposed transitively by shark-graph, avoid increasing
 androidX-collections = { module = "androidx.collection:collection-ktx", version = "1.4.0" }
 
-androidSupport = { module = "com.android.support:support-v4", version = "28.0.0" }
-assertjCore = { module = "org.assertj:assertj-core", version = "3.9.1" }
-clikt = { module = "com.github.ajalt:clikt", version = "2.3.0" }
-neo4j = { module = "org.neo4j:neo4j", version = "4.4.6" }
-curtains = { module = "com.squareup.curtains:curtains", version = "1.2.4" }
+assertjCore = { module = "org.assertj:assertj-core", version = "3.27.7" }
+# AssertJ 3.16.0 builds java.time formatters in StandardRepresentation's static initializer, and
+# java.time only exists from API 26, so on API 24 the very first assertion dies with a
+# NoClassDefFoundError. Instrumentation tests run on every API level LeakCanary supports, so they
+# stay on the last version that loads there. Unit tests run on the JVM and use the version above.
+assertjCore-android = { module = "org.assertj:assertj-core", version = "3.15.0" }
+clikt = { module = "com.github.ajalt:clikt", version = "2.8.0" }
+neo4j = { module = "org.neo4j:neo4j", version = "4.4.48" }
+curtains = { module = "com.squareup.curtains:curtains", version = "1.2.5" }
 jline = { module = "jline:jline", version = "2.14.6" }
 junit = { module = "junit:junit", version = "4.13.2" }
 kotlinStatistics = { module = "org.nield:kotlin-statistics", version = "1.2.1" }
-mockito = { module = "org.mockito:mockito-core", version = "3.5.10" }
-mockitoKotlin = { module = "com.nhaarman.mockitokotlin2:mockito-kotlin", version = "2.2.0" }
-robolectric = { module = "org.robolectric:robolectric", version = "4.0-alpha-3" }
+mockito = { module = "org.mockito:mockito-core", version = "5.23.0" }
+mockitoKotlin = { module = "org.mockito.kotlin:mockito-kotlin", version = "6.3.0" }
+# Exposed transitively by every published module that reads heap dumps, avoid increasing
 okio2 = { module = "com.squareup.okio:okio", version = "2.2.2" }
 sqldelight-android = { module = "app.cash.sqldelight:android-driver", version.ref = "sqldelight" }
 sqldelight-coroutines = { module = "app.cash.sqldelight:coroutines-extensions", version.ref = "sqldelight" }
+
+# Only used by leakcanary-app, the standalone UI app, which isn't published, so these can track the
+# latest release.
+androidX-activity-compose = { module = "androidx.activity:activity-compose", version = "1.13.0" }
+# androidx.core 1.19.0 requires compiling against the Android 37 SDK
+androidX-core = { module = "androidx.core:core-ktx", version = "1.18.0" }
+androidX-lifecycle-runtime = { module = "androidx.lifecycle:lifecycle-runtime-ktx", version.ref = "lifecycle" }
+androidX-lifecycle-viewModelCompose = { module = "androidx.lifecycle:lifecycle-viewmodel-compose", version.ref = "lifecycle" }
+androidX-sqlite-framework = { module = "androidx.sqlite:sqlite-framework", version = "2.7.0" }
+compose-material3 = { module = "androidx.compose.material3:material3", version = "1.4.0" }
+# The Material icons stopped shipping with Compose Material 3 and are frozen at 1.7.8.
+compose-materialIcons = { module = "androidx.compose.material:material-icons-core", version = "1.7.8" }
+compose-ui = { module = "androidx.compose.ui:ui", version.ref = "compose" }
+compose-ui-tooling = { module = "androidx.compose.ui:ui-tooling", version.ref = "compose" }
+compose-ui-toolingPreview = { module = "androidx.compose.ui:ui-tooling-preview", version.ref = "compose" }
+extendedSpans = { module = "me.saket.extendedspans:extendedspans", version = "1.4.0" }

leakcanary/leakcanary-android-core/build.gradle.kts

@@ -19,12 +19,10 @@ dependencies {
   testImplementation(libs.assertjCore)
   testImplementation(libs.junit)
   testImplementation(libs.kotlin.reflect)
-  testImplementation(libs.mockito)
-  testImplementation(libs.mockitoKotlin)
   androidTestImplementation(libs.androidX.test.espresso)
   androidTestImplementation(libs.androidX.test.rules)
   androidTestImplementation(libs.androidX.test.runner)
-  androidTestImplementation(libs.assertjCore)
+  androidTestImplementation(libs.assertjCore.android)
   androidTestImplementation(projects.shark.sharkHprofTest)
   androidTestUtil(libs.androidX.test.orchestrator)
 }