Remove unused dependencies; enforce the Gson version floor with a constraint

[bmander]

Summary

Drops external dependencies that aren't referenced anywhere in app source, resources, or the manifest, and replaces the Gson "version pin via unused dependency" hack with a proper dependency constraint.

This came out of an audit that cross-referenced every catalog coordinate against real usage — necessary because neither the Kotlin compiler nor Android Lint flags an unused dependency (they analyze code correctness, not build-graph reachability), so this dead weight is invisible to the normal CI gates.

Removed (unused)

Dependency	Why it's safe to drop
androidx.fragment:fragment-ktx	No Fragment subclasses remain; app is fully Activity + Compose.
androidx.cardview:cardview	Replaced by Compose Card; only doc-comment mentions of the legacy CardView remained.
androidx.constraintlayout:constraintlayout	No app:layout_constraint* in any XML, no imports; layout is Compose.
org.apache.commons:commons-lang3	Zero references. (commons-io is used and is kept.)
androidx.concurrent:concurrent-futures + concurrent-listenablefuture (+ -callback)	A ListenableFuture pin for WorkManager with no direct usage. The build's checkDuplicateClasses + dex merge pass without it, confirming it was not resolving a Guava/ListenableFuture conflict.

Gson: constraint instead of a phantom dependency

Gson had no call sites but was declared implementation(libs.gson) purely to force a transitive copy up. That's an unused library standing in for a version requirement. Replaced with a dependency constraint that floors the version only where Gson actually appears (transitively via firebase-firestore → io.grpc:grpc-core) without adding it to the classpath.

The old rationale was also stale: Gson isn't pulled in at 2.8.5 — it arrives at 2.10.1, already past the 2.8.9 CVE-2022-25647 fix. The constraint now honestly documents that it floors the transitive up to the catalog version (2.14.0) as forward protection against a future grpc/Firebase downgrade, not as a live-vuln patch.

Resolution is unchanged: Gson still resolves to 2.14.0 (now (c) / "By constraint" in dependencyInsight, no longer a direct edge).

Verification

• assembleObaGoogleDebug -PwarningsAsErrors=true → BUILD SUCCESSFUL (green, no new warnings), including resource merge, checkDuplicateClasses, and dex merge.
• After the Gson change the assemble is UP-TO-DATE, so the packaged APK is byte-identical — a behavior-preserving refactor.
• Built the obaGoogle variant locally; CI covers the rest of the grid + lint.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Refactor

  • Removed unused and unsupported dependency references.
  • Updated Compose dependencies and strengthened Gson version enforcement.

• Tests

  • Migrated Compose UI tests to the newer unconfined test rule.
  • Added a shared test helper to preserve existing test behavior while removing deprecated rule usage.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 8ebabb60-e0da-470c-b0e2-816314ac5a19

📥 Commits

Reviewing files that changed from the base of the PR and between 07adb02 and 3ed5221.

📒 Files selected for processing (9)

• gradle/libs.versions.toml
• onebusaway-android/build.gradle.kts
• onebusaway-android/src/androidTest/java/org/onebusaway/android/ui/arrivals/ArrivalAlertIndicatorTest.kt
• onebusaway-android/src/androidTest/java/org/onebusaway/android/ui/arrivals/EtaStripJustifyTest.kt
• onebusaway-android/src/androidTest/java/org/onebusaway/android/ui/arrivals/RouteArrivalRowLongPressTest.kt
• onebusaway-android/src/androidTest/java/org/onebusaway/android/ui/compose/ComposeTestRules.kt
• onebusaway-android/src/androidTest/java/org/onebusaway/android/ui/compose/components/SlideBoxTest.kt
• onebusaway-android/src/androidTest/java/org/onebusaway/android/ui/home/arrivals/ServiceAlertsDialogTest.kt
• onebusaway-android/src/androidTest/java/org/onebusaway/android/ui/home/map/FocusBannerTest.kt

💤 Files with no reviewable changes (1)

• gradle/libs.versions.toml

---

📝 Walkthrough

Walkthrough

The PR removes unused Gradle catalog entries, updates dependency constraints and the Compose BOM, adds a shared unconfined Compose test rule, and migrates seven UI tests from the deprecated Compose rule.

Changes

Dependency and Compose test updates

Layer / File(s)	Summary
Gradle dependency catalog and wiring gradle/libs.versions.toml, onebusaway-android/build.gradle.kts	Unused AndroidX and Commons Lang entries are removed, Gson is pinned through a dependency constraint, and the Compose BOM is updated.
Unconfined Compose rule helper onebusaway-android/src/androidTest/java/org/onebusaway/android/ui/compose/ComposeTestRules.kt	Adds createUnconfinedComposeRule() using the Compose v2 rule with UnconfinedTestDispatcher.
Compose test rule migration onebusaway-android/src/androidTest/java/org/onebusaway/android/ui/arrivals/*Test.kt, onebusaway-android/src/androidTest/java/org/onebusaway/android/ui/compose/components/SlideBoxTest.kt, onebusaway-android/src/androidTest/java/org/onebusaway/android/ui/home/*/*Test.kt	Migrates seven Compose UI tests to the shared rule and removes deprecated-rule suppressions.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related issues

• Migrate EtaStripJustifyTest off deprecated createComposeRule (v2 breaks onGloballyPositioned dispatch) #1792 — The shared unconfined rule and EtaStripJustifyTest migration address the issue’s Compose dispatcher behavior.

Possibly related PRs

• OneBusAway/onebusaway-android#1941 — Directly overlaps with the shared Compose test rule migration.
• OneBusAway/onebusaway-android#1791 — Directly relates to the EtaStripJustifyTest Compose rule setup.
• OneBusAway/onebusaway-android#1838 — Directly relates to the Gradle version catalog changes.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately reflects the two main changes: unused dependency removal and switching Gson pinning to a constraint.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/remove-unused-deps

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}