Upgrade project dependencies

[dokar3]

Summary by CodeRabbit

• Build and Tooling

  • Updated Gradle, Kotlin, Compose, Android, and coroutines tooling to newer versions.
  • Improved Gradle wrapper reliability and refreshed startup scripts.
  • Updated CI and publishing workflows to newer action versions and macOS runners.

• Platform Support

  • Removed the Intel iOS simulator target from sample and library builds.

[coderabbitai]

📝 Walkthrough

Walkthrough

CI actions, Gradle and wrapper tooling, and Kotlin Multiplatform iOS targets were updated. The Windows wrapper’s process-exit flow was reworked, while workflow structure and published artifact paths remained unchanged.

Changes

Build modernization

Layer / File(s)	Summary
CI and publishing actions .github/workflows/*	Checkout, Pages artifact upload, and Pages deployment actions were upgraded; library publishing now uses macos-26.
Gradle and dependency toolchain gradle/libs.versions.toml, gradle/wrapper/gradle-wrapper.properties	Gradle, Kotlin, Compose, AndroidX, and coroutines versions were updated, along with wrapper distribution and retry settings.
Wrapper scripts gradlew, gradlew.bat	POSIX wrapper comments and template references were refreshed, and Windows environment initialization and exit handling were reworked.
iOS target configuration sample/build.gradle.kts, sonner/build.gradle.kts	The iosX64() target was removed from both iOS framework configurations.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• dokar3/compose-sonner#96: Updates the same version catalog and removes the iosX64 target from related Kotlin Multiplatform configuration.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title matches the main theme of the changes: dependency and toolchain upgrades across Gradle, workflows, and build scripts.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch deps-upgrades-2607

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 Checkov (3.3.8)

.github/workflows/build.yaml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

.github/workflows/publish-library.yaml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

.github/workflows/publish-wasmjs-demo.yaml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

• 1 others

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/publish-library.yaml:
- Line 13: Disable persisted checkout credentials by configuring the
actions/checkout step with persist-credentials: false in
.github/workflows/publish-library.yaml (13-13), .github/workflows/build.yaml
(14-14), and .github/workflows/publish-wasmjs-demo.yaml (21-21).

In `@gradle/wrapper/gradle-wrapper.properties`:
- Around line 3-6: Update the Gradle wrapper configuration by changing the
retries property from zero to a positive retry count, such as 3, while
preserving the existing distributionUrl, networkTimeout, and retryBackOffMs
settings.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 4be3c122-583f-4881-81b7-23d3a19a39d7

📥 Commits

Reviewing files that changed from the base of the PR and between 7a35159 and 3028cb8.

⛔ Files ignored due to path filters (2)

• gradle/wrapper/gradle-wrapper.jar is excluded by !**/*.jar
• kotlin-js-store/yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (9)

• .github/workflows/build.yaml
• .github/workflows/publish-library.yaml
• .github/workflows/publish-wasmjs-demo.yaml
• gradle/libs.versions.toml
• gradle/wrapper/gradle-wrapper.properties
• gradlew
• gradlew.bat
• sample/build.gradle.kts
• sonner/build.gradle.kts

💤 Files with no reviewable changes (1)

• sample/build.gradle.kts

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Disable persisted checkout credentials in all workflows.

actions/checkout keeps credential persistence enabled by default, making the token available to later authenticated commands. These workflows execute repository-controlled Gradle code immediately afterward; set persist-credentials: false unless a later step explicitly requires Git authentication. (github.com)

• .github/workflows/publish-library.yaml#L13-L13: add with: persist-credentials: false.
• .github/workflows/build.yaml#L14-L14: add with: persist-credentials: false.
• .github/workflows/publish-wasmjs-demo.yaml#L21-L21: add with: persist-credentials: false.

Proposed fix

       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	- uses: actions/checkout@v7
	- uses: actions/checkout@v7
	with:
	persist-credentials: false

🧰 Tools

🪛 zizmor (1.26.1)

[warning] 13-13: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

📍 Affects 3 files

• .github/workflows/publish-library.yaml#L13-L13 (this comment)
• .github/workflows/build.yaml#L14-L14
• .github/workflows/publish-wasmjs-demo.yaml#L21-L21

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/publish-library.yaml at line 13, Disable persisted
checkout credentials by configuring the actions/checkout step with
persist-credentials: false in .github/workflows/publish-library.yaml (13-13),
.github/workflows/build.yaml (14-14), and
.github/workflows/publish-wasmjs-demo.yaml (21-21).

Source: Linters/SAST tools

[coderabbitai]

🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win

Restore network retries for wrapper downloads.

Setting retries=0 removes resiliency against transient network failures when downloading the Gradle distribution, which can lead to spurious CI build failures. Consider retaining a positive value (e.g., retries=3).

🛠️ Proposed fix

 networkTimeout=10000
-retries=0
+retries=3
 retryBackOffMs=500

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	distributionUrl=https\://services.gradle.org/distributions/gradle-9.6.1-bin.zip
	networkTimeout=10000
	retries=0
	retryBackOffMs=500
	networkTimeout=10000
	retries=3
	retryBackOffMs=500

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@gradle/wrapper/gradle-wrapper.properties` around lines 3 - 6, Update the
Gradle wrapper configuration by changing the retries property from zero to a
positive retry count, such as 3, while preserving the existing distributionUrl,
networkTimeout, and retryBackOffMs settings.