build: update Kotlin to 2.2.21 and Poko to 0.20.2

[AlvaroBrey]

Part of the AGP 9 upgrade pre-work. Bumps Kotlin 2.0.21 to 2.2.21 and Poko 0.17.2 to 0.20.2.

• Kotlin lands on 2.2.21, not 2.2.10: Poko 0.20.0 dropped support for Kotlin 2.2.0 and 2.2.10 "due to incompatibility", and 0.20.2 is compiled against 2.2.21. Poko's old IR plugin in turn crashes under any Kotlin 2.2 compiler, so both versions have to move together and 2.2.21 is the pairing upstream supports.
• Consumer-facing caveat, and the reason this wants a major release: the published POM carries kotlin-stdlib at the compiler version in compile scope, so consumers on an older Kotlin fail with Module was compiled with an incompatible version of Kotlin. The binary version of its metadata is 2.2.0, expected version is 2.0.0. This effectively raises the minimum Kotlin a consumer needs.
• kotlinLanguage stays at 1.8, but note that only sets our own languageVersion/apiVersion. It does not govern the stdlib we publish, so it does not keep the above caveat away.
• test-apps/sdksizetesting moves to the same Kotlin version. It consumes the locally published artifacts, so it is a worked example of the consumer break described above rather than an unrelated tweak.
• Drops a stdlib pin in dokka-hide-internal that existed only because the repo's Kotlin was older than Dokka's analysis Kotlin; they now match.
• Stacked on fix(paywalls): Expose compose-foundation-layout so PaywallFooter is callable without extra setup #3961. The api-tester workaround this PR used to carry is gone, because fix(paywalls): Expose compose-foundation-layout so PaywallFooter is callable without extra setup #3961 exports compose-foundation-layout from :ui:revenuecatui properly.

Checklist

• If applicable, unit tests
• If applicable, create follow-up issues for purchases-ios and hybrids

Agent description

Motivation

Part of the AGP 9 upgrade, split into small independently-shippable PRs. Poko 0.17.2's IR compiler
plugin crashes under the Kotlin 2.2 compiler (NoSuchMethodError: irEqeqeq), so the two version
bumps have to land together.

The exact pairing matters. Poko's changelog for 0.20.0 says "Compile with Kotlin 2.2.20. Drop
support for Kotlin 2.2.0 and 2.2.10 due to incompatibility", and 0.20.2 is compiled with 2.2.21.
An earlier revision of this PR paired Kotlin 2.2.10 with Poko 0.20.2, which built and tested green
but is an unsupported combination upstream. Poko is an IR plugin, so the failure modes are a loud
NoSuchMethodError or silently wrong generated equals/hashCode/toString, across 111 @Poko
types in published modules. Moving Kotlin to 2.2.21 puts us on the combination Poko actually
targets.

The Kotlin compiler version and the Kotlin language/API level (kotlinLanguage) are
separate knobs in this build (ConfigureAndroidLibrary.kt): every library module sets
languageVersion/apiVersion from kotlinLanguage, not from the compiler version. This PR bumps
only the compiler and leaves kotlinLanguage = "1.8".

That does not make the change invisible to consumers, and an earlier revision of this
description wrongly claimed it did. The Kotlin Gradle Plugin publishes kotlin-stdlib at the
compiler version in compile scope, Gradle resolves the highest version, and an older consumer
compiler then cannot read that stdlib's metadata. sdksizetesting hit exactly this and needed its
own Kotlin bumped to keep consuming the SDK. The practical minimum Kotlin for consumers therefore
moves with this PR, which is being tracked for the release that carries it.

Description

• Kotlin 2.0.21 to 2.2.21, Poko 0.17.2 to 0.20.2.
• test-apps/sdksizetesting Kotlin bumped to match, so it can still read the SDK's metadata.
• dokka-hide-internal stdlib pin removed.

Ordering note

This PR was originally stacked on #3935 (Metalava 0.4.0-alpha03 to 0.5.0), which has since merged.
Metalava was split out because it stands on its own, but the order mattered and both ways were
tested directly. With Metalava still at 0.4.0-alpha03, bumping Kotlin alone produces a small but
real api*.txt diff: Metalava cannot parse Kotlin 2.2's metadata format and silently drops the
throws clause it synthesizes from @Throws on at least one method. The compiled bytecode was
confirmed unaffected via javap, but the tracked signature file loses it. With Metalava bumped
first, this combination produces zero api*.txt diff.

Testing

• scripts/api-check.sh clean with zero signature diff.
• :purchases unit tests green, detektAll clean.
• Compiled every module applying the Poko plugin (:purchases, :ui:revenuecatui,
  :feature:admob, :feature:galaxy) to confirm the IR-plugin crash does not reproduce.
• :api-tester compiles with no Compose layout dependency of its own, which is the end to end
  check that fix(paywalls): Expose compose-foundation-layout so PaywallFooter is callable without extra setup #3961 underneath this branch does its job.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	maven/​org.jetbrains.kotlin/​kotlin-test@​2.0.21 ⏵ 2.2.21
	maven/​org.jetbrains.kotlin/​kotlin-gradle-plugin@​2.0.21 ⏵ 2.2.21	+35		+11

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: maven org.jetbrains.kotlin:kotlin-daemon-client is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → maven/org.jetbrains.kotlin/kotlin-gradle-plugin@2.2.21 → maven/org.jetbrains.kotlin/kotlin-daemon-client@2.2.21 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/org.jetbrains.kotlin/kotlin-daemon-client@2.2.21. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: maven org.jetbrains.kotlin:kotlin-gradle-plugin is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: examples/CustomEntitlementComputationSample/gradle/libs.versions.toml → maven/org.jetbrains.kotlin/kotlin-gradle-plugin@2.2.21 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/org.jetbrains.kotlin/kotlin-gradle-plugin@2.2.21. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: maven org.jetbrains.kotlin:kotlin-gradle-plugin is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: examples/CustomEntitlementComputationSample/gradle/libs.versions.toml → maven/org.jetbrains.kotlin/kotlin-gradle-plugin@2.2.21 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/org.jetbrains.kotlin/kotlin-gradle-plugin@2.2.21. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[emerge-tools]

📸 Snapshot Test

621 unchanged

Name	Added	Removed	Modified	Renamed	Unchanged	Errored	Approval
TestPurchasesUIAndroidCompatibility com.revenuecat.testpurchasesuiandroidcompatibility	0	0	0	0	339	0	N/A
TestPurchasesUIAndroidCompatibility Paparazzi com.revenuecat.testpurchasesuiandroidcompatibility.paparazzi	0	0	0	0	282	0	N/A

---

🛸 Powered by Emerge Tools

[tonidero]

Nice!! 🙇 Thank you thank you!

[tonidero]

Hmm I wonder if the need of doing this should be considered a breaking change... I guess it would be mostly fine, as long as folks were mostly able to make it work without it... But I wonder if we should include/expose this from our ui module...

[AlvaroBrey]

This is not a breaking change (not anymore than it already was, I mean), it hasn't hit us for the same reasons as: #3916, basically everyone who ships an android nowadays transitively includes compose.foundation.layout anyway.

But we should expose it in the UI module to make it explicit, separate PR incoming.

[AlvaroBrey]

#3961

[AlvaroBrey]

Waiting for #3947 merge (which fixes maestro broken on this branch)

[cursor]

Stdlib bump breaks older consumers

High Severity

Bumping kotlin to 2.2.10 while leaving kotlinLanguage at 1.8 still publishes kotlin-stdlib:2.2.10 (compile scope) via the Kotlin Gradle Plugin. Consumers on Kotlin 2.0.x and below then fail with incompatible metadata errors—the same issue that forced the sdksizetesting bump—so the advertised Kotlin 1.8 minimum is no longer accurate.

Additional Locations (1)

• test-apps/sdksizetesting/gradle/libs.versions.toml#L2-L5

 

^{Reviewed by Cursor Bugbot for commit e9f498e. Configure here.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 82.72%. Comparing base (f6924a3) to head (1382809).

Additional details and impacted files

@@                           Coverage Diff                            @@
##           fix/expose-compose-foundation-layout    #3934      +/-   ##
========================================================================
+ Coverage                                 82.68%   82.72%   +0.03%     
========================================================================
  Files                                       425      425              
  Lines                                     17475    17472       -3     
  Branches                                   2629     2629              
========================================================================
+ Hits                                      14450    14453       +3     
+ Misses                                     2138     2132       -6     
  Partials                                    887      887              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 0912ec0. Configure here.}

[cursor]

Unsupported Kotlin and Poko pairing

Medium Severity

kotlin 2.2.10 is paired with poko 0.20.2, but Poko 0.20.0+ dropped Kotlin 2.2.10 support due to incompatibility and targets 2.2.20+. @Poko types in public modules may hit IR-plugin failures or incorrect generated equals/hashCode/toString. Poko 0.19.3 matches 2.2.10, or Kotlin can move to 2.2.21 with 0.20.2.

 

^{Reviewed by Cursor Bugbot for commit 0912ec0. Configure here.}

[AlvaroBrey]

Further testing reveals we actually need kotlin 2.3+ for proper AGP + our supporting plugins compatibility, so this intermediate step is uesless