chore: float dependency versions within major and update release-secrets action to v1.2.1

[devin-ai-integration]

Summary

Weekly SDK-examples sweep: the app's library dependencies now float within their current major version so routine patch/minor releases need no PR, plus a CI-only pin refresh.

• app/build.gradle dependency constraints changed from exact pins to Gradle ranges that keep today's version as the floor: launchdarkly-android-client-sdk:[5.16.0,6.0.0), androidx.core:core-ktx:[1.19.0,2.0.0), androidx.appcompat:appcompat:[1.8.0,2.0.0). They resolve to the same versions today (5.16.0 / 1.19.0 / 1.8.0), so this is behavior-neutral now and self-updating later.
• launchdarkly/gh-actions/actions/release-secrets pinned SHA bumped release-secrets-v1.2.0 → v1.2.1, which moves the action to aws-actions/configure-aws-credentials v6 (node24) — Dependabot does not track this subdirectory action, so it had been stale since 2024.
• Fixed the stale release-note comments above the actions/checkout, actions/setup-java and android-emulator-runner pins (they pointed at v4.2.2 / v4.7.1 / v2.38.0 while the SHAs are v7.0.1 / v6.0.0 / v2.38.0).
• GitHub Actions pins, the Gradle wrapper, AGP/com.android.library plugin versions and compileSdk/minSdk/targetSdk are deliberately left pinned — they are toolchain/supply-chain pins, not library dependencies.
• actions/setup-java v6.0.1 intentionally left for Dependabot's 7-day cooldown window.

Implementation details

Floating-constraint verification on this machine (Gradle 9.7.1, AGP 9.4.0, compileSdk 37, JDK 17): ./gradlew assembleDebug --refresh-dependencies succeeded, and ./gradlew :app:dependencies --configuration debugRuntimeClasspath shows the ranges resolving to the expected latest-within-major versions:

+--- com.launchdarkly:launchdarkly-android-client-sdk:[5.16.0,6.0.0) -> 5.16.0
+--- androidx.core:core-ktx:[1.19.0,2.0.0) -> 1.19.0
\--- androidx.appcompat:appcompat:[1.8.0,2.0.0) -> 1.8.0

Maven metadata confirms 5.16.0 is the newest 5.x SDK, 1.19.0 the newest core-ktx 1.x and 1.8.0 the newest appcompat 1.x, so the ranges do not silently move today. Gradle's default dynamic-version cache is 24h, so CI picks up new releases within the major on the next day's run.

End-to-end run: ./gradlew installDebug onto a local API 34 google_apis x86_64 emulator with the hello-apps mobile key and hello-boolean flag key injected the same way run.yml does; uiautomator dump reported The 'hello-boolean' feature flag evaluates to true. (keys were injected locally only and are not committed).

Notes on the range idiom: [5.16.0,6.0.0) is used rather than 5.+ because the latter has no floor and would allow versions below the current one. Gradle treats these ranges as dynamic versions; there is no committed lockfile in this repo, so nothing else needs regenerating. The README documents no dependency versions, so no prose changes were needed.

Earlier in this branch: the Run workflow passes with the new release-secrets pin — the Get mobile key and flag key step (v1.2.1) fetches the SSM parameters and the emulator step still asserts the flag is true. The first attempt on commit 437f8d2 hung in the Run on emulator step for over an hour (that step normally takes ~90s) and was left to time out; the identical rerun on e64f630 passed in ~3 minutes, so it was a runner-side emulator hang, not a regression.

Deprecated-API check: javap -v over launchdarkly-android-client-sdk-5.16.0 shows none of the APIs the example uses (LDConfig.Builder(AutoEnvAttributes), mobileKey, LDContext.builder, LDClient.init(app, config, context, 5), LDClient.get, boolVariation, registerFeatureFlagListener) are deprecated.

com.android.library stays at 9.3.2 in the root build.gradle: Dependabot's bump to 9.4.0 (#65) was closed with an ignore, so the mismatch with com.android.application 9.4.0 is deliberate. The plugin is declared apply false and no module applies it.

Link to Devin session: https://app.devin.ai/sessions/b8de27d27c66438a931b0089cec22d72
Open in Devin Desktop: https://app.devin.ai/desktop/session/b8de27d27c66438a931b0089cec22d72?variant=devin

---

Note

Overview
Gradle library dependencies in app/build.gradle switch from fixed versions to major-bounded ranges ([floor, nextMajor)), so patch/minor updates within the current major can land without a PR while keeping today’s resolved versions unchanged.

CI bumps launchdarkly/gh-actions release-secrets from v1.2.0 to v1.2.1 in run.yml (AWS credential helper refresh). Workflow comments above pinned actions/checkout, actions/setup-java, and android-emulator-runner SHAs are corrected to match the versions already in use; action commit pins themselves are unchanged except release-secrets.

^{Reviewed by Cursor Bugbot for commit 6e60cf9. Bugbot is set up for automated code reviews on this repo. Configure here.}

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

@cursor review

[devin-ai-integration]

@cursor review