[dependabot]

Dependabot bump of 41 Gradle dependencies and the wrapper (9.5.0 → 9.8.2), plus the follow-up changes the bump needs to build, test and lint cleanly. Security review of the library diff: #1787 (comment)

Description

• Bump dependencies per the table below (Dependabot). Glance stays on stable 1.2.0 instead of the proposed 1.3.0-alpha02, which Dependabot offered only because the old pin was a release candidate.
• compileSdk 36 → 37: coil 3.6, haze 1.7.3, core 1.19, navigation 2.10, hilt 1.4, glance and the Compose 1.12 / lifecycle 2.11 they pull in all require it, which failed checkDevDebugAarMetadata. targetSdk stays 36.
• Nix dev shell installs SDK platform 37.0 to match compileSdk.
• Wrapper pins distributionSha256Sum for the Gradle 9.8.2 distribution.
• Replace APIs the bumps deprecate:
  • Gradle 9.6 delegate DSL in app/build.gradle.kts.
  • core-ktx bundleOf.
  • launch(Job) in PubkyRepo: now a child scope with the same context.
  • API 37 connectGatt in the Jade and Trezor transports: BluetoothGattConnectionSettings on 37+, with automatic MTU off because both transports request their own MTU; legacy call below 37. A null GATT handle now returns a transport error instead of throwing.
• Drop seven empty super.onCleared() calls; lifecycle 2.11 marks ViewModel.onCleared @EmptySuper, so lint fails on them.
• Tests:
  • ElectrumProbeServiceTest.kt detaches Conscrypt while its TLS tests run. Robolectric 4.17's Conscrypt 2.6 breaks JDK TLS init for later tests in the same JVM.
  • ScreenDeepLinkDetachmentTest.kt builds its graph with rememberNavController(). navigation-testing 2.10's TestNavHostController binds the application context, so it no longer handles the activity intent on graph creation.
• Security changelog fragment for BouncyCastle 1.86.

Out of Scope

• AppViewModel: an unaffordable scanned payment can open a disabled Amount screen. Pre-existing on master (46cd209), fixed separately in fix: show insufficient funds when no hardware wallet covers a scan #1790. Review: chore: bump the gradle group across 1 directory with 41 updates #1787 (review)
• targetSdk 37: opts into Android 17 runtime behavior changes; separate PR.
• Gradle dependency verification metadata / lockfiles: recommended in the security review, separate PR.

Design

N/A — no UI changes.

Preview

N/A

QA Notes

Setup

• Dev flavor (just build / just install), regtest against staging Blocktank.
• Case 1 needs a physical Android 17 (API 37) phone with Bluetooth and a Trezor Safe 5/7 or Blockstream Jade.

Journeys

N/A — no user-visible behaviour change. The widget journeys under journeys/ still apply to the Glance/Compose bumps; widget results are in Evidence.

Manual Tests

• 1. On an Android 17 phone, pair a Trezor and a Jade over BLE, then sign a send → pairing, connect and signing succeed as on master — BLE pairing not in Capabilities

Automated Checks

• updated ElectrumProbeServiceTest.kt — TLS probe tests no longer depend on test order under Robolectric 4.17
• updated ScreenDeepLinkDetachmentTest.kt — attached screen URIs are handled on graph creation by an activity-backed controller
• ran ScreenDeepLinkDetachmentTest.kt, UsdtPaymentNavigationTest.kt, ReceiveNavigationTest.kt locally on an emulator (CI runs the full instrumented suite)

Evidence

• 3ee74ba and 71bd1fe, local, macOS, JDK 17:
  • just compile, just test (4878 tests, 0 failures) and just lint pass.
  • connectedDevDebugAndroidTest for the three navigation test classes: 9/9 pass on a Pixel 9 emulator (API 37.1).
  • ScreenDeepLinkDetachmentTest.kt failed there before 3ee74ba, same as CI.
• 6ac59c0, Pixel 9 emulator (API 37.1):
  • All five home screen widgets add, configure, render live data and match master (chore: bump the gradle group across 1 directory with 41 updates #1787 (comment)).
  • App smoke test passed: onboarding, wallet creation, home, Receive sheet.
• 70bca24: the pinned nixpkgs evaluates the dev shell and builds platforms/android-37.0 (revision 2, the same package AGP used locally). Checked in a nixos/nix container, x86_64-linux evaluation.

Gaps

• 1. not run: no Android 17 phone or hardware wallet available. The new connectGatt branch only runs on API 37+.
• nix develop followed by just compile was not run end to end; only the platform package was built in a container.
• Full instrumented suite at 71bd1fe: pending CI.

Models used

• Planning/scoping: claude-opus-5-5 (reasoning: medium)
• Implementation: claude-opus-5-5 (reasoning: medium)
• Review: claude-fable-5-1 (reasoning: high), claude-opus-5-5 (reasoning: Not exposed), Unknown
• Review rounds: 3

Metadata note: the claude-opus-5-5 review is the talosmachina review, which reported its effort as not exposed. Unknown is the coreyphillips review, which reports no model.

---

Dependabot: updated packages

Release notes and changelogs for each package are in commit fd6949c; they were removed from this description to stay under GitHub's body size limit.

Bumps the gradle group with 41 updates in the / directory:

Package	From	To
org.jetbrains.kotlinx:atomicfu	0.23.1	0.33.0
gradle-wrapper	9.5.0	9.8.2
androidx.appcompat:appcompat	1.7.1	1.8.0
org.bouncycastle:bcpkix-jdk18on	1.83	1.86
org.bouncycastle:bcprov-jdk18on	1.83	1.86
androidx.constraintlayout:constraintlayout-compose	1.1.1	1.1.2
androidx.core:core-ktx	1.17.0	1.19.1
androidx.datastore:datastore-preferences	1.2.1	1.3.0
io.nlopez.compose.rules:detekt	0.5.3	0.6.8
androidx.glance:glance-appwidget	1.2.0-rc01	1.2.0 (pinned stable; Dependabot proposed 1.3.0-alpha02)
androidx.glance:glance-material3	1.2.0-rc01	1.2.0 (pinned stable; Dependabot proposed 1.3.0-alpha02)
androidx.glance:glance-material3	1.2.0-rc01	1.2.0 (pinned stable; Dependabot proposed 1.3.0-alpha02)
androidx.hilt:hilt-compiler	1.3.0	1.4.0
androidx.hilt:hilt-navigation-compose	1.3.0	1.4.0
androidx.hilt:hilt-work	1.3.0	1.4.0
androidx.hilt:hilt-navigation-compose	1.3.0	1.4.0
androidx.hilt:hilt-work	1.3.0	1.4.0
net.java.dev.jna:jna	5.18.1	5.19.1
org.jetbrains.kotlinx:kotlinx-collections-immutable	0.3.8	0.5.2
org.jetbrains.kotlinx:kotlinx-datetime	0.7.1	0.8.0
io.ktor:ktor-client-cio	3.3.3	3.6.1
io.ktor:ktor-client-content-negotiation	3.3.3	3.6.1
io.ktor:ktor-client-core	3.3.3	3.6.1
io.ktor:ktor-client-logging	3.3.3	3.6.1
io.ktor:ktor-client-mock	3.3.3	3.6.1
io.ktor:ktor-client-okhttp	3.3.3	3.6.1
io.ktor:ktor-serialization-kotlinx-json	3.3.3	3.6.1
io.ktor:ktor-client-content-negotiation	3.3.3	3.6.1
io.ktor:ktor-client-core	3.3.3	3.6.1
io.ktor:ktor-client-logging	3.3.3	3.6.1
io.ktor:ktor-client-mock	3.3.3	3.6.1
io.ktor:ktor-client-okhttp	3.3.3	3.6.1
io.ktor:ktor-serialization-kotlinx-json	3.3.3	3.6.1
com.google.android.material:material	1.13.0	1.14.0
androidx.navigation:navigation-compose	2.9.6	2.10.2
androidx.navigation:navigation-testing	2.9.6	2.10.2
androidx.navigation:navigation-testing	2.9.6	2.10.2
androidx.room:room-compiler	2.8.4	2.8.5
androidx.room:room-ktx	2.8.4	2.8.5
androidx.room:room-runtime	2.8.4	2.8.5
androidx.room:room-testing	2.8.4	2.8.5
androidx.room	2.8.4	2.8.5
androidx.room:room-ktx	2.8.4	2.8.5
androidx.room:room-runtime	2.8.4	2.8.5
androidx.room:room-testing	2.8.4	2.8.5
org.slf4j:slf4j-api	2.0.17	2.0.20
org.slf4j:slf4j-simple	2.0.17	2.0.20
org.slf4j:slf4j-simple	2.0.17	2.0.20
org.mockito.kotlin:mockito-kotlin	6.2.2	6.4.0
org.robolectric:robolectric	4.16.1	4.17
androidx.work:work-runtime-ktx	2.11.0	2.12.0
io.coil-kt.coil3:coil-bom	3.2.0	3.6.3
dev.chrisbanes.haze:haze	1.7.1	1.7.3
dev.chrisbanes.haze:haze-materials	1.7.1	1.7.3
com.google.gms.google-services	4.4.4	4.5.0
androidx.room	2.8.4	2.8.5

[greptile-apps]

This PR does not match any of the 1 configured review trigger rule.

[jvsena42]

Review: build fixes and regressions from the bumps

All CI jobs were failing on checkDevDebugAarMetadata. I pushed fixes on top of the bump, merged with current master.

What broke and what changed

Problem	Cause	Fix (commit)
checkDevDebugAarMetadata fails, 25 AAR issues	coil 3.6.3, haze 1.7.3, core 1.19.1, navigation 2.10.2, hilt 1.4.0, glance 1.3.0-alpha02, plus the Compose 1.12.0 / lifecycle 2.11.0 / okhttp 5.5.1 they pull in, all require compileSdk 37	compileSdk = 37. targetSdk stays 36: none of the libraries require it, and raising it opts the app into Android 17 runtime behavior changes, so it belongs in its own PR (034bf57)
Glance moved from 1.2.0-rc01 to 1.3.0-alpha02	Dependabot offers pre-releases when the current pin is a pre-release	Pinned to 1.2.0 stable (034bf57)
New deprecation warnings (master compiles with none)	Gradle 9.6+ delegate DSL, core-ktx 1.19 bundleOf, kotlinx-coroutines launch(Job), API 37 connectGatt	Replaced the call sites instead of relying on -Xwarning-level=DEPRECATION:warning (cad60a9). connectGatt uses BluetoothGattConnectionSettings on API 37+ with automatic MTU off, because Jade and Trezor request their own MTU. API < 37 keeps the legacy overload. A null GATT handle now returns a transport error instead of throwing an NPE
lintDevDebug: 7 × EmptySuperCall	lifecycle 2.11 marks ViewModel.onCleared @EmptySuper	Removed the 7 super.onCleared() calls; the super method is empty, so behavior is unchanged (d9c5e1c)
ElectrumProbeServiceTest: 2 TLS tests fail depending on test order	Robolectric 4.17 bundles Conscrypt 2.6.2 (was 2.5.2), whose EC AlgorithmParameters rejects binary-field curves. JDK NamedGroup init resolves EC params from the provider list, so once a Robolectric class leaves Conscrypt first, SunJSSE fails to initialise for the rest of the JVM. Reproduced by running AppWidgetRefreshReceiverTest before it: fails on 4.17, passes on 4.16.1	Test detaches Conscrypt in @BeforeClass and restores it at the same position in @AfterClass (f329165). Test-only; Android runtime unaffected
Wrapper download not verified	gradle-wrapper.properties has no distributionSha256Sum	Added the official 9.8.2 bin.zip sha256 (034bf57)

Also added changelog.d/next/1787.security.md for the BouncyCastle update.

Verification (local, JDK 17, macOS)

• ./gradlew assembleDevDebug assembleDevDebugAndroidTest detekt testDevDebugUnitTest lintDevDebug: BUILD SUCCESSFUL, zero compiler warnings, all unit tests pass.
• Emulator, Pixel 9 on API 37.1, PR build vs the master CI APK (6ee86de):
  • All 5 home screen widgets add, configure, render live data and open their config on tap.
  • Cancelling a reconfigure keeps the existing widget.
  • Screenshots are in a separate comment.
  • App smoke test: onboarding, wallet creation, home, and the Receive sheet with QR. No crashes or ANRs from the app.
• Not tested: Jade/Trezor BLE connection on a physical device. The connectGatt change only takes effect on API 37+, and the emulator has no BLE peer. This needs a hardware-wallet check on an Android 17 device before merge.

Behavior changes in the bumps that touch app code (no action taken)

• Per the ktor 3.6 release notes, ktor ranks client engines by priority instead of ServiceLoader order. With both OkHttp and CIO on the classpath, HttpClient {} in di/HttpModule.kt now picks OkHttp deterministically. Declaring HttpClient(OkHttp) explicitly would remove the dependence on that rule.
• Per the coil 3.6 release notes, coil decodes truncated images by default (allowPartialImage). The app's only fetcher is PubkyImageFetcher, which caps bodies at 1 MiB; PubkyImageFetcherTest passes.
• This branch now has non-Dependabot commits, so Dependabot will no longer rebase it. Rebase or merge master by hand if it falls behind.

Security review of the library diff is in the next comment.

🤖 Generated with Claude Code

[jvsena42]

Security review of the library diff

Scope: every direct bump in this PR plus the transitive moves CI surfaced (Compose 1.12.0, lifecycle 2.11.0, okhttp 5.2.1 → 5.5.1).

Sources:

• GitHub Advisory DB and OSV.dev for each old and new version
• Vendor release notes
• PGP signer key IDs on Maven Central / Google Maven
• Merged-manifest diffs of the old and new AARs

Each item says whether it was checked directly or taken from release notes.

Summary

• No known advisory affects any of the new versions (GitHub Advisory DB and OSV, checked per version).
• The BouncyCastle and Gradle bumps close known High/Critical advisories that apply to this app. They are the most important changes in the PR.
• No new permissions, exported components, cleartext settings or backup flags come in through the new AARs. All 18 old/new AAR manifest diffs only raise library minSdk (to 23/24; the app is on 28). The one exception is glance's tools:overrideLibrary.

Gradle wrapper 9.5.0 → 9.8.2 (verified)

• gradle-wrapper.jar sha256 3b8a25775a69158b5ad2b1d17a80a88dc7b40a352a73eb27d06c612a7ce68e98 matches https://services.gradle.org/distributions/gradle-9.8.2-wrapper.jar.sha256 byte for byte.
• gradlew / gradlew.bat match the upstream v9.8.2 scripts except DEFAULT_JVM_OPTS, which also carries -Dfile.encoding=UTF-8 (the same line appears in gradle/gradle's own scripts). No added URLs, eval, downloads or exec paths.
• The master wrapper jar matched no official 6.7–9.7.1 checksum. It dated from the initial commit and was never regenerated, so this PR also replaces an unverifiable binary with a verified one.
• Fixes three High advisories that affect 9.0.0–9.8.0, all fixed in 9.8.1:
  • GHSA-j5m7-59rp-24f5: repositories failing SSL not disabled, allowing artifact substitution
  • GHSA-xwqc-3h47-hg64: client–daemon deserialization before auth
  • GHSA-mvvg-497x-hmj8: worker–daemon deserialization
• Pushed: distributionSha256Sum for the 9.8.2 bin.zip (21bd5da2…e389607, official value).

BouncyCastle bcprov 1.83 → 1.86 (bcpkix is test-only)

The app replaces Android's stripped BC with full bcprov at provider position 1 (Crypto.kt:56). It uses BC for secp256k1 keygen/ECDH, AES-GCM and ECDSA. Because it sits at position 1, BC can also serve JCA lookups the platform makes for X.509 and cert paths, so BC's parsing and PKIX fixes matter here.

Advisories affecting 1.83, checked in the GitHub Advisory DB:

Advisory	Severity	Fixed in	Relevance
GHSA-9pwp-9qqc-pr26 CVE-2026-8763, name-constraints bypass via trailing dot in rfc822Name/URI	critical	1.85	certificate path validation; reachable through BC at position 1
GHSA-qp49-qgx5-5m26 CVE-2026-13506, lazy ASN.1 sequence resets nesting-depth guard	high	1.85	ASN.1 parsing of untrusted input (certificates, keys)
GHSA-574f-3g2m-x479 CVE-2025-14813, GOST CTR keystream reuse	critical	1.84	not used by the app
GHSA-p93r-85wp-75v3 CVE-2026-5598, covert timing channel (FrodoKEM)	high	1.84	not used
GHSA-c3fc-8qff-9hwx CVE-2026-0636, LDAP injection	medium	1.84	not used
GHSA-wg6q-6289-32hp CVE-2026-5588, bcpkix	medium	1.84	test classpath only

The BC release notes for 1.85/1.86 list further fixes not yet in the GitHub DB, several in certificate and ASN.1 handling (RSA PKCS#1 verify, OCSP binding, BKS keystore, definite-length OOM).

Behavior risks:

• 1.86 removes legacy PQC schemes (Rainbow, Picnic, old Dilithium/Kyber wrappers); the app uses none of them.
• CryptoTest and AppTest (provider install order) pass.
• The signing key is unchanged.

Network stack

• ktor 3.3.3 → 3.6.1: no advisories in range. The client keeps install(Logging) { level = LogLevel.NONE }, so no header/body logging comes in. The JSON config (isLenient, ignoreUnknownKeys) is app-side and unchanged. Release notes include CIO TLS fixes (KTOR-9318, KTOR-9974). The engine is now OkHttp by priority ranking; see the review comment.
• okhttp 5.2.1 → 5.5.1 (transitive): no advisories. Hardening from release notes:
  • blocklist of compromised eMudhra intermediates (5.5.1)
  • stricter IP canonicalization in hostname verification (5.5.0)
  • 256 KiB cap on HTTP/2 headers (5.4.0)
• okhttp signing key changed in 5.5.0, after the project moved to Commonhaus. The new key 6751E1A6E2001B8D matches the fingerprint announced in OkHttp's changelog (5DD80B0DDCCBE005F0A47FD66751E1A6E2001B8D). Verified against the .asc files. It's the only signer change in the PR.

Other libraries

Library	From → To	Notes	Verdict
JNA	5.18.1 → 5.19.1	libjnidispatch.so byte-identical for every ABI (sha256 compared); only Java classes changed	negligible
coil	3.2.0 → 3.6.3	only PubkyImageFetcher is wired, no coil network fetcher; partial-image decoding now on by default	low
datastore, room, work, navigation, appcompat, core, material, constraintlayout, hilt, haze	minor/patch	manifest diffs are minSdk-only	negligible
glance	1.2.0-rc01 → 1.3.0-alpha02	pre-release in production widget code	changed to 1.2.0 stable
kotlinx-datetime, collections-immutable, atomicfu (debug-only), slf4j	minor	API-level changes only	negligible
google-services plugin	4.4.4 → 4.5.0	build-time; adds reCAPTCHA site-key processing	negligible
detekt compose-rules, mockito-kotlin, robolectric	build/test only	robolectric's Conscrypt bump broke a TLS test; fixed, see review comment	n/a

Supply chain (verified)

• Every new coordinate resolves from the expected repository with pom, artifact and .asc. No lookalike groups; no group ID changed in libs.versions.toml.
• Signer key IDs are unchanged for bcprov, ktor, jna, coil, slf4j, kotlinx-datetime, haze, mockito-kotlin, robolectric and compose-rules. okhttp is the only change (see above).
• CI's gradle/actions/setup-gradle@v6 validates the wrapper jar.
• The repo has no gradle/verification-metadata.xml and no lockfiles. Dependency updates land without artifact hash or signature pinning.

Recommendations

1. Merge the BouncyCastle and Gradle bumps even if other parts of this PR stall.
2. Follow-up: enable Gradle dependency verification (./gradlew --write-verification-metadata pgp,sha256 help) so signer changes like okhttp's come up in review instead of passing silently.
3. Optional: declare HttpClient(OkHttp) explicitly.

🤖 Generated with Claude Code

[jvsena42]

Home screen widgets: Glance 1.2.0-rc01 → 1.2.0

The PR now pins Glance to 1.2.0 stable instead of 1.3.0-alpha02, and the widget code also runs on Compose 1.12 / lifecycle 2.11 via the other bumps. I added all five widgets on an emulator to compare this PR's build against the master CI APK (6ee86de).

Setup:

• Pixel 9 emulator, API 37.1, Pixel Launcher
• Dev flavor
• Widgets added through the launcher's widget picker and saved through each config screen

Results (PR build)

Widget	Adds from picker	Config screen	Renders live data	Tap opens config
Bitcoin Price	yes	yes	yes	yes
Bitcoin Headlines	yes	yes	yes	yes
Bitcoin Blocks	yes	yes	yes	n/c
Bitcoin Weather	yes	yes	yes	n/c
Bitcoin Facts	yes	none (by design)	yes	n/c

n/c = not checked; only Price was tapped. Cancelling a reconfigure (Back from the config opened by tapping) keeps the existing widget. Rendering matches master for every widget: same layout, typography, colors and icons. Values differ only because the data is live.

master vs PR

master	PR
	(Blocks is at the top of the PR page above)

Config screens (PR build)

Price	Headlines	Blocks	Weather

The Blocks config shows the built-in sample block (761,405, 2022) on both master and PR.

In-app smoke test (PR build)

Onboarding, wallet creation, home and the Receive sheet all work. No crash or ANR from the app.

Note: Pixel Launcher hit ANRs during the run while a 13-minute Gradle build was loading the host; system apps (systemui, gms, dialer) ANR'd at the same time. Unrelated to Bitkit.

🤖 Generated with Claude Code

[github-actions]

Regtest APK

Built from 71bd1fe (run).

Download bitkit-dev-debug universal APK (expires in 30 days).

[talosmachina]

No findings. Dependabot bumps 41 Gradle dependencies and the wrapper to 9.8.2. Follow-up commits by @jvsena42 move compileSdk to 37 (targetSdk stays 36), port the BLE connects and coroutine launches off APIs the bumps deprecate, and isolate the Electrum probe TLS tests from Conscrypt. Reviewed 6ac59c06a9574bc73e8dc5c6230f9761d1fd235b, full tier, static: the branch was not built here, so the evidence is the code plus CI.

What I checked, and 6 candidates I ruled out

Read in full: ext/Bluetooth.kt, the BLE connect paths and GATT callbacks in JadeTransport.kt and TrezorTransport.kt, ContactProfileRefresh and queueRefreshedContact in PubkyRepo.kt, ElectrumProbeServiceTest.kt, utils/Crypto.kt, app/build.gradle.kts, libs.versions.toml
Wrapper: distributionSha256Sum and the sha256 of the committed gradle-wrapper.jar both match what services.gradle.org publishes for 9.8.2
CI at this head: build-and-test (assembleDevDebug plus unit tests) and build-local green. lint, compose-ui and the local e2e matrix were still running when this was posted

Ruled out

• BLE connect semantics on API 37: connectGattDirect keeps the old transports (Jade TRANSPORT_LE, Trezor TRANSPORT_AUTO, the old 3-arg overload's default) and autoConnect=false. Its direct executor delivers callbacks on the Binder thread, as the handler-less legacy overload did. Automatic MTU is off and both transports still call requestMtu themselves (JadeTransport.kt:857, TrezorTransport.kt:1172). A null BluetoothGatt now returns a transport error instead of being stored.
• Dropped super.onCleared(): all seven classes extend ViewModel() directly, and its onCleared is an empty hook.
• refreshScope in PubkyRepo: CoroutineScope(scope.coroutineContext + job).launch gives the same context and parent as scope.launch(job, ...), so cancelling job still cancels the lookups, finish and the batched apply.
• BouncyCastle 1.86 KeyAgreement state check: Crypto.kt:120 never calls generateSecret and computes the ECDH point itself, so the new IllegalStateException path is not reached. CryptoTest runs in the green unit job.
• Conscrypt detach in the test: @BeforeClass and @AfterClass put the provider back at its original index, so nothing leaks to other test classes in the same JVM.
• tasks.register / configurations.create rewrite: the task name syncNativeDebugSymbolArtifacts, which release.yml, release-internal.yml and create-native-debug-symbols.sh call by name, is unchanged, and the nativeDebugSymbols(...) dependency calls still resolve through the val.

Merge confidence: 4/5. No test covers the new API 37 BLE connect branch (CI runs no hardware-wallet pairing), and lint and e2e were still pending.

Reviewer model: claude-opus-5-5
Reasoning effort: Not exposed (the run metadata available to this reviewer does not report it)

[coreyphillips]

Two independent reviews.

worth doing, does not block

• Nix dev shell still installs only SDK platform 36 while compileSdk is now 37 (flake.nix:56). flake.nix still installs only platform 36, and its comment ties that value to compileSdk. androidenv builds the SDK inside the read-only /nix/store, so AGP cannot auto-install platforms;android-37 there. Inside nix develop, just compile should then fail because the API 37 platform is missing. I could not run Nix on this machine, so I have not confirmed the failure. CI does not use the flake. The fix is to add 37 (under whatever package name nixpkgs uses for 37.0) and update the "Gradle 9.5" comment on line 71.
• Unaffordable scans open a disabled amount screen (app/src/main/java/to/bitkit/viewmodels/AppViewModel.kt:5444-5447). An unaffordable scanned payment can open an Amount screen with both editing and Continue disabled. With Savings at zero, a hardware balance of 10,000 sats, and hardware spendable funds of 8,000 sats, scan a request for 9,000 sats. The initial guard accepts the raw hardware balance, but selection here fails. Returning false opens Amount, where fixedOnchainAmount disables editing and isAmountInputValid remains false. This path should report insufficient funds.

the reviewers disagree, your call

• PR description lists glance 1.3.0-alpha02 and omits the API 37 and BLE changes (general). Objection: The catalog and diff confirm Glance 1.2.0 and the API 37/BLE changes. The current PR description could not be retrieved, so I cannot independently confirm its stale version or missing QA notes. Answer: gh pr view 1787 at head 6ac59c0 returns Dependabot's original body. Its table still lists glance-appwidget and glance-material3 going from 1.2.0-rc01 to 1.3.0-alpha02, but gradle/libs.versions.toml pins glance = "1.2.0". The body never mentions compileSdk, GATT, Conscrypt or onCleared, and it has no QA section, so the follow-up commits (034bf57 through 6ac59c0) aren't described.

[jvsena42]

Replies to coreyphillips' review (#1787 (review)):

Nix dev shell only installs platform 36: fixed in 70bca24. platformVersions = [ "37.0" ] and the comment now says Gradle 9.8.

• The pinned nixpkgs (d6524aac) exposes 37.0 and 37.1. AGP resolved compileSdk = 37 to platforms/android-37.0 (revision 2) locally.
• In a nixos/nix container, the flake's devShells.x86_64-linux.default evaluates, and the same nixpkgs builds android-sdk-platforms-37.0 with libexec/android-sdk/platforms/android-37.0 (AndroidVersion.ApiLevel=37.0, Pkg.Revision=2).
• Not run: nix develop followed by just compile end to end, since Nix isn't installed on this machine.

Unaffordable scans open a disabled Amount screen: real, but it predates this PR, so it's fixed separately in #1790.

• Added by 46cd209 (fix: open review for requests with an amount #1763); this PR doesn't touch routeOnchainInvoiceAmount.
• Checked the latest PRs and branches: none fix it. fix: compose a hardware-funded request once #1785, fix: keep signed hardware sends on retry #1770 and spar/issue-1144 predate fix: open review for requests with an amount #1763 and don't contain that function.
• fix: show insufficient funds when no hardware wallet covers a scan #1790 adds AppViewModelSendFlowTest "main scanner onchain scan the hardware balance but not its spendable covers shows insufficient funds", using your numbers (Savings 0, hardware balance 10 000, spendable 8 000, scan 9 000). It failed before the fix (the Send sheet opened) and passes after.
• iOS makes the same raw-balance pre-check but lands on Confirm with a "Try again" toast and a disabled swipe; noted in fix: show insufficient funds when no hardware wallet covers a scan #1790.

PR description stale: fixed. The description now follows the template:

• What changed and why.
• Out of Scope, with the scan finding linked to fix: show insufficient funds when no hardware wallet covers a scan #1790.
• QA notes: a BLE manual case on Android 17, evidence and gaps.
• Models used.
• Glance rows in the Dependabot table now show 1.2.0.

Also in this push (3ee74ba): compose-ui failed on ScreenDeepLinkDetachmentTest.testAttachedScreenUriIsHandledByGraphWithoutGate. navigation-testing 2.10's TestNavHostController now passes context.applicationContext to NavHostController, so it finds no Activity and doesn't handle the activity intent when the graph is created. The test now uses rememberNavController(), which builds the controller with the activity context as MainActivity does. Production is unaffected. The test reproduced the failure on a Pixel 9 emulator (API 37.1) before the change. After it, the three navigation test classes pass 9/9 there.

Gate at 71bd1fe: just compile, just test (4878 tests, 0 failures), just lint pass.

🤖 Generated with Claude Code

[coreyphillips]

Rechecked after 4 new commits (3ee74ba, 70bca24, 328bbfb, 71bd1fe). Nothing blocking remains.

addressed

• Nix dev shell still installs only SDK platform 36 while compileSdk is now 37 (flake.nix:56). Fixed: flake.nix:56 now has platformVersions = [ "37.0" ], and the line 71 comment says Gradle 9.8. I fetched androidenv's repo.json at the pinned nixpkgs rev d6524aac: key 37.0 maps to platforms/android-37.0. The local SDK's android-37.0 reports AndroidVersion.ApiLevel=37.0, Pkg.Revision=2, the directory AGP uses for compileSdk = 37. Like you, I did not run nix develop end to end.
• PR description lists glance 1.3.0-alpha02 and omits the API 37 and BLE changes. Fixed: gh pr view 1787 at 71bd1fe shows the rewritten body. It covers compileSdk 37, the API 37 connectGatt path and null GATT handling, the dropped onCleared calls, and the Conscrypt and deep link test changes. Glance is pinned at 1.2.0, and the QA notes add the BLE manual case 1 with its gap recorded.
• Unaffordable scans open a disabled amount screen (app/src/main/java/to/bitkit/viewmodels/AppViewModel.kt:5444-5447). Rebutted: Your reply holds. routeOnchainInvoiceAmount came from 46cd209 (#1763), which is an ancestor of origin/master. git diff origin/master...HEAD -- AppViewModel.kt only removes super.onCleared(), so this branch does not cause the dead-end Amount screen. #1790 is open, touches AppViewModel.kt and adds AppViewModelSendFlowTest coverage for it.

new since the last review

nits

• Flake description still says Android SDK 36 (flake.nix:2). The description at the top of flake.nix still says Android SDK 36/NDK r28b. After 70bca24 the shell installs only platform 37.0. nix flake show and nix flake metadata display this string, so it now gives the wrong platform. Changing it to SDK 37 matches line 56.

[jvsena42]

Nit on flake.nix:2 (#1787 (review)): confirmed, the description still said SDK 36. This PR was merged before I got to it, so the fix is in #1792 (25ce099).

• nix flake metadata there prints "Android SDK 37/NDK r28b".
• The dev shell derivation is unchanged by the edit.

🤖 Generated with Claude Code