build(deps)!: upgrade AGP to 9.3.0 and bump compileSdk to 37

[demolaf]

• Closeschore(deps): bump android-gradle-plugin from 8.10.0 to 9.3.1 #2429
• Related to chore(deps): bump com.vanniktech.maven.publish from 0.34.0 to 0.37.0 #2364
• Related to chore(deps): bump glide from 5.0.7 to 5.0.9 #2430
• Related to chore(deps): bump androidx.core:core-ktx from 1.13.1 to 1.19.0 #2371
• Related to chore(deps): bump androidx.compose:compose-bom from 2026.06.01 to 2026.08.00 #2451

Dependabot's com.vanniktech.maven.publish bump (0.34.0 → 0.37.0, #2364) fails CI because 0.36.0+ requires AGP ≥ 8.13.0, and no AGP 8.x release is compatible with this repo's Gradle 9.7.0 wrapper (AGP 8.11–8.13.x depend on an internal Gradle API removed in 9.6.0). This upgrades AGP to 9.3.0 to unblock it — that part alone has no consumer impact, verified by publishing to mavenLocal() and confirming the AAR metadata is unchanged from the pre-upgrade baseline.

It also bumps compileSdk 36 → 37, to unblock a separate cluster of stuck dependabot PRs (#2430 glide, #2371 core-ktx, #2451 compose-bom) whose newer versions were themselves built against compileSdk 37 and can't be consumed while we're at 36. This part does have real consumer impact: the published AAR now stamps minCompileSdk=37, so consumers still on AGP 8.10.0 (max recommended compileSdk 36) will need to upgrade AGP to pick up the next FirebaseUI-Android release. That's a deliberate, accepted tradeoff for unblocking those PRs, not an oversight.

#2429 is dependabot's own attempt at this same AGP bump (8.10.0 → 9.3.1) - it hit the identical org.jetbrains.kotlin.android/AGP-9-defaults wall this PR already resolves, so merging this supersedes it.

• gradle.properties: added android.builtInKotlin=false and android.newDsl=false to keep org.jetbrains.kotlin.android working under AGP 9's defaults - both flags are deprecated and removed in AGP 10, so the real Kotlin/new-DSL migration is deferred to a follow-up.
• proguard-tests/build.gradle.kts: migrated the removed postprocessing {} block to isMinifyEnabled/isShrinkResources.
• common/build.gradle.kts, storage/build.gradle.kts: removed a dangling consumerProguardFiles("proguard-rules.pro") pointing at a file that's never existed — silently ignored under AGP 8, hard-fails release builds under AGP 9. Neither module has dependencies needing consumer keep rules.
• auth, database, firestore, storage: implementation(platform(libs.firebase.bom)) → api(platform(libs.firebase.bom)), fixing an AGP 9 dependency-resolution regression where the BOM's version constraint wasn't propagating to modules already exposing these artifacts via api.
• buildSrc/src/main/kotlin/Config.kt: compileSdk 36 → 37 (targetSdk intentionally left at 36 - all modules set it explicitly, so AGP 9's "target defaults to compile" default never fires; target ≤ compile is a valid combination).

---

Maintainer note: Fixes internal CPRN-146

[gemini-code-assist]

Code Review

This pull request upgrades the Android Gradle Plugin to version 9.3.0, updates Firebase BOM dependencies from implementation to api across multiple modules, and removes consumer ProGuard files from common and storage modules. Additionally, it replaces the experimental postprocessing block with standard minification properties in the proguard-tests module. The reviewer recommends specifying default Android ProGuard rules when enabling minification to prevent potential runtime crashes due to aggressive shrinking or obfuscation.

[demolaf]

• Closeschore(deps): bump android-gradle-plugin from 8.10.0 to 9.3.1 #2429
• Related to chore(deps): bump com.vanniktech.maven.publish from 0.34.0 to 0.37.0 #2364
• Related to chore(deps): bump glide from 5.0.7 to 5.0.9 #2430
• Related to chore(deps): bump androidx.core:core-ktx from 1.13.1 to 1.19.0 #2371
• Related to chore(deps): bump androidx.compose:compose-bom from 2026.06.01 to 2026.08.00 #2451

Dependabot's com.vanniktech.maven.publish bump (0.34.0 → 0.37.0, #2364) fails CI because 0.36.0+ requires AGP ≥ 8.13.0, and no AGP 8.x release is compatible with this repo's Gradle 9.7.0 wrapper (AGP 8.11–8.13.x depend on an internal Gradle API removed in 9.6.0). This upgrades AGP to 9.3.0 to unblock it — that part alone has no consumer impact, verified by publishing to mavenLocal() and confirming the AAR metadata is unchanged from the pre-upgrade baseline.

It also bumps compileSdk 36 → 37, to unblock a separate cluster of stuck dependabot PRs (#2430 glide, #2371 core-ktx, #2451 compose-bom) whose newer versions were themselves built against compileSdk 37 and can't be consumed while we're at 36. This part does have real consumer impact: the published AAR now stamps minCompileSdk=37, so consumers still on AGP 8.10.0 (max recommended compileSdk 36) will need to upgrade AGP to pick up the next FirebaseUI-Android release. That's a deliberate, accepted tradeoff for unblocking those PRs, not an oversight.

#2429 is dependabot's own attempt at this same AGP bump (8.10.0 → 9.3.1) - it hit the identical org.jetbrains.kotlin.android/AGP-9-defaults wall this PR already resolves, so merging this supersedes it.

• gradle.properties: added android.builtInKotlin=false and android.newDsl=false to keep org.jetbrains.kotlin.android working under AGP 9's defaults - both flags are deprecated and removed in AGP 10, so the real Kotlin/new-DSL migration is deferred to a follow-up.
• proguard-tests/build.gradle.kts: migrated the removed postprocessing {} block to isMinifyEnabled/isShrinkResources.
• common/build.gradle.kts, storage/build.gradle.kts: removed a dangling consumerProguardFiles("proguard-rules.pro") pointing at a file that's never existed — silently ignored under AGP 8, hard-fails release builds under AGP 9. Neither module has dependencies needing consumer keep rules.
• auth, database, firestore, storage: implementation(platform(libs.firebase.bom)) → api(platform(libs.firebase.bom)), fixing an AGP 9 dependency-resolution regression where the BOM's version constraint wasn't propagating to modules already exposing these artifacts via api.
• buildSrc/src/main/kotlin/Config.kt: compileSdk 36 → 37 (targetSdk intentionally left at 36 - all modules set it explicitly, so AGP 9's "target defaults to compile" default never fires; target ≤ compile is a valid combination).

---

Maintainer note: Fixes internal CPRN-146

[gemini-code-assist]

Code Review

This pull request upgrades the Android Gradle Plugin to version 9.3.0, updates Firebase BOM dependencies from implementation to api across multiple modules, and removes consumer ProGuard files from common and storage modules. Additionally, it replaces the experimental postprocessing block with standard minification properties in the proguard-tests module. The reviewer recommends specifying default Android ProGuard rules when enabling minification to prevent potential runtime crashes due to aggressive shrinking or obfuscation.

[demolaf]

• Closeschore(deps): bump android-gradle-plugin from 8.10.0 to 9.3.1 #2429
• Related to chore(deps): bump com.vanniktech.maven.publish from 0.34.0 to 0.37.0 #2364
• Related to chore(deps): bump glide from 5.0.7 to 5.0.9 #2430
• Related to chore(deps): bump androidx.core:core-ktx from 1.13.1 to 1.19.0 #2371
• Related to chore(deps): bump androidx.compose:compose-bom from 2026.06.01 to 2026.08.00 #2451

Dependabot's com.vanniktech.maven.publish bump (0.34.0 → 0.37.0, #2364) fails CI because 0.36.0+ requires AGP ≥ 8.13.0, and no AGP 8.x release is compatible with this repo's Gradle 9.7.0 wrapper (AGP 8.11–8.13.x depend on an internal Gradle API removed in 9.6.0). This upgrades AGP to 9.3.0 to unblock it — that part alone has no consumer impact, verified by publishing to mavenLocal() and confirming the AAR metadata is unchanged from the pre-upgrade baseline.

It also bumps compileSdk 36 → 37, to unblock a separate cluster of stuck dependabot PRs (#2430 glide, #2371 core-ktx, #2451 compose-bom) whose newer versions were themselves built against compileSdk 37 and can't be consumed while we're at 36. This part does have real consumer impact: the published AAR now stamps minCompileSdk=37, so consumers still on AGP 8.10.0 (max recommended compileSdk 36) will need to upgrade AGP to pick up the next FirebaseUI-Android release. That's a deliberate, accepted tradeoff for unblocking those PRs, not an oversight.

#2429 is dependabot's own attempt at this same AGP bump (8.10.0 → 9.3.1) - it hit the identical org.jetbrains.kotlin.android/AGP-9-defaults wall this PR already resolves, so merging this supersedes it.

• gradle.properties: added android.builtInKotlin=false and android.newDsl=false to keep org.jetbrains.kotlin.android working under AGP 9's defaults - both flags are deprecated and removed in AGP 10, so the real Kotlin/new-DSL migration is deferred to a follow-up.
• proguard-tests/build.gradle.kts: migrated the removed postprocessing {} block to isMinifyEnabled/isShrinkResources.
• common/build.gradle.kts, storage/build.gradle.kts: removed a dangling consumerProguardFiles("proguard-rules.pro") pointing at a file that's never existed — silently ignored under AGP 8, hard-fails release builds under AGP 9. Neither module has dependencies needing consumer keep rules.
• auth, database, firestore, storage: implementation(platform(libs.firebase.bom)) → api(platform(libs.firebase.bom)), fixing an AGP 9 dependency-resolution regression where the BOM's version constraint wasn't propagating to modules already exposing these artifacts via api.
• buildSrc/src/main/kotlin/Config.kt: compileSdk 36 → 37 (targetSdk intentionally left at 36 - all modules set it explicitly, so AGP 9's "target defaults to compile" default never fires; target ≤ compile is a valid combination).

---

Maintainer note: Fixes internal CPRN-146

[gemini-code-assist]

Code Review

This pull request upgrades the Android Gradle Plugin to version 9.3.0, updates Firebase BOM dependencies from implementation to api across multiple modules, and removes consumer ProGuard files from common and storage modules. Additionally, it replaces the experimental postprocessing block with standard minification properties in the proguard-tests module. The reviewer recommends specifying default Android ProGuard rules when enabling minification to prevent potential runtime crashes due to aggressive shrinking or obfuscation.

[demolaf]

• Closeschore(deps): bump android-gradle-plugin from 8.10.0 to 9.3.1 #2429
• Related to chore(deps): bump com.vanniktech.maven.publish from 0.34.0 to 0.37.0 #2364
• Related to chore(deps): bump glide from 5.0.7 to 5.0.9 #2430
• Related to chore(deps): bump androidx.core:core-ktx from 1.13.1 to 1.19.0 #2371
• Related to chore(deps): bump androidx.compose:compose-bom from 2026.06.01 to 2026.08.00 #2451

Dependabot's com.vanniktech.maven.publish bump (0.34.0 → 0.37.0, #2364) fails CI because 0.36.0+ requires AGP ≥ 8.13.0, and no AGP 8.x release is compatible with this repo's Gradle 9.7.0 wrapper (AGP 8.11–8.13.x depend on an internal Gradle API removed in 9.6.0). This upgrades AGP to 9.3.0 to unblock it — that part alone has no consumer impact, verified by publishing to mavenLocal() and confirming the AAR metadata is unchanged from the pre-upgrade baseline.

It also bumps compileSdk 36 → 37, to unblock a separate cluster of stuck dependabot PRs (#2430 glide, #2371 core-ktx, #2451 compose-bom) whose newer versions were themselves built against compileSdk 37 and can't be consumed while we're at 36. This part does have real consumer impact: the published AAR now stamps minCompileSdk=37, so consumers still on AGP 8.10.0 (max recommended compileSdk 36) will need to upgrade AGP to pick up the next FirebaseUI-Android release. That's a deliberate, accepted tradeoff for unblocking those PRs, not an oversight.

#2429 is dependabot's own attempt at this same AGP bump (8.10.0 → 9.3.1) - it hit the identical org.jetbrains.kotlin.android/AGP-9-defaults wall this PR already resolves, so merging this supersedes it.

• gradle.properties: added android.builtInKotlin=false and android.newDsl=false to keep org.jetbrains.kotlin.android working under AGP 9's defaults - both flags are deprecated and removed in AGP 10, so the real Kotlin/new-DSL migration is deferred to a follow-up.
• proguard-tests/build.gradle.kts: migrated the removed postprocessing {} block to isMinifyEnabled/isShrinkResources.
• common/build.gradle.kts, storage/build.gradle.kts: removed a dangling consumerProguardFiles("proguard-rules.pro") pointing at a file that's never existed — silently ignored under AGP 8, hard-fails release builds under AGP 9. Neither module has dependencies needing consumer keep rules.
• auth, database, firestore, storage: implementation(platform(libs.firebase.bom)) → api(platform(libs.firebase.bom)), fixing an AGP 9 dependency-resolution regression where the BOM's version constraint wasn't propagating to modules already exposing these artifacts via api.
• buildSrc/src/main/kotlin/Config.kt: compileSdk 36 → 37 (targetSdk intentionally left at 36 - all modules set it explicitly, so AGP 9's "target defaults to compile" default never fires; target ≤ compile is a valid combination).

---

Maintainer note: Fixes internal CPRN-146

[gemini-code-assist]

Code Review

This pull request upgrades the Android Gradle Plugin to version 9.3.0, updates Firebase BOM dependencies from implementation to api across multiple modules, and removes consumer ProGuard files from common and storage modules. Additionally, it replaces the experimental postprocessing block with standard minification properties in the proguard-tests module. The reviewer recommends specifying default Android ProGuard rules when enabling minification to prevent potential runtime crashes due to aggressive shrinking or obfuscation.

[demolaf]

• Closeschore(deps): bump android-gradle-plugin from 8.10.0 to 9.3.1 #2429
• Related to chore(deps): bump com.vanniktech.maven.publish from 0.34.0 to 0.37.0 #2364
• Related to chore(deps): bump glide from 5.0.7 to 5.0.9 #2430
• Related to chore(deps): bump androidx.core:core-ktx from 1.13.1 to 1.19.0 #2371
• Related to chore(deps): bump androidx.compose:compose-bom from 2026.06.01 to 2026.08.00 #2451

Dependabot's com.vanniktech.maven.publish bump (0.34.0 → 0.37.0, #2364) fails CI because 0.36.0+ requires AGP ≥ 8.13.0, and no AGP 8.x release is compatible with this repo's Gradle 9.7.0 wrapper (AGP 8.11–8.13.x depend on an internal Gradle API removed in 9.6.0). This upgrades AGP to 9.3.0 to unblock it — that part alone has no consumer impact, verified by publishing to mavenLocal() and confirming the AAR metadata is unchanged from the pre-upgrade baseline.

It also bumps compileSdk 36 → 37, to unblock a separate cluster of stuck dependabot PRs (#2430 glide, #2371 core-ktx, #2451 compose-bom) whose newer versions were themselves built against compileSdk 37 and can't be consumed while we're at 36. This part does have real consumer impact: the published AAR now stamps minCompileSdk=37, so consumers still on AGP 8.10.0 (max recommended compileSdk 36) will need to upgrade AGP to pick up the next FirebaseUI-Android release. That's a deliberate, accepted tradeoff for unblocking those PRs, not an oversight.

#2429 is dependabot's own attempt at this same AGP bump (8.10.0 → 9.3.1) - it hit the identical org.jetbrains.kotlin.android/AGP-9-defaults wall this PR already resolves, so merging this supersedes it.

• gradle.properties: added android.builtInKotlin=false and android.newDsl=false to keep org.jetbrains.kotlin.android working under AGP 9's defaults - both flags are deprecated and removed in AGP 10, so the real Kotlin/new-DSL migration is deferred to a follow-up.
• proguard-tests/build.gradle.kts: migrated the removed postprocessing {} block to isMinifyEnabled/isShrinkResources.
• common/build.gradle.kts, storage/build.gradle.kts: removed a dangling consumerProguardFiles("proguard-rules.pro") pointing at a file that's never existed — silently ignored under AGP 8, hard-fails release builds under AGP 9. Neither module has dependencies needing consumer keep rules.
• auth, database, firestore, storage: implementation(platform(libs.firebase.bom)) → api(platform(libs.firebase.bom)), fixing an AGP 9 dependency-resolution regression where the BOM's version constraint wasn't propagating to modules already exposing these artifacts via api.
• buildSrc/src/main/kotlin/Config.kt: compileSdk 36 → 37 (targetSdk intentionally left at 36 - all modules set it explicitly, so AGP 9's "target defaults to compile" default never fires; target ≤ compile is a valid combination).

---

Maintainer note: Fixes internal CPRN-146

[gemini-code-assist]

Code Review

This pull request upgrades the Android Gradle Plugin to version 9.3.0, updates Firebase BOM dependencies from implementation to api across multiple modules, and removes consumer ProGuard files from common and storage modules. Additionally, it replaces the experimental postprocessing block with standard minification properties in the proguard-tests module. The reviewer recommends specifying default Android ProGuard rules when enabling minification to prevent potential runtime crashes due to aggressive shrinking or obfuscation.

[demolaf]

• Closeschore(deps): bump android-gradle-plugin from 8.10.0 to 9.3.1 #2429
• Related to chore(deps): bump com.vanniktech.maven.publish from 0.34.0 to 0.37.0 #2364
• Related to chore(deps): bump glide from 5.0.7 to 5.0.9 #2430
• Related to chore(deps): bump androidx.core:core-ktx from 1.13.1 to 1.19.0 #2371
• Related to chore(deps): bump androidx.compose:compose-bom from 2026.06.01 to 2026.08.00 #2451

Dependabot's com.vanniktech.maven.publish bump (0.34.0 → 0.37.0, #2364) fails CI because 0.36.0+ requires AGP ≥ 8.13.0, and no AGP 8.x release is compatible with this repo's Gradle 9.7.0 wrapper (AGP 8.11–8.13.x depend on an internal Gradle API removed in 9.6.0). This upgrades AGP to 9.3.0 to unblock it — that part alone has no consumer impact, verified by publishing to mavenLocal() and confirming the AAR metadata is unchanged from the pre-upgrade baseline.

It also bumps compileSdk 36 → 37, to unblock a separate cluster of stuck dependabot PRs (#2430 glide, #2371 core-ktx, #2451 compose-bom) whose newer versions were themselves built against compileSdk 37 and can't be consumed while we're at 36. This part does have real consumer impact: the published AAR now stamps minCompileSdk=37, so consumers still on AGP 8.10.0 (max recommended compileSdk 36) will need to upgrade AGP to pick up the next FirebaseUI-Android release. That's a deliberate, accepted tradeoff for unblocking those PRs, not an oversight.

#2429 is dependabot's own attempt at this same AGP bump (8.10.0 → 9.3.1) - it hit the identical org.jetbrains.kotlin.android/AGP-9-defaults wall this PR already resolves, so merging this supersedes it.

• gradle.properties: added android.builtInKotlin=false and android.newDsl=false to keep org.jetbrains.kotlin.android working under AGP 9's defaults - both flags are deprecated and removed in AGP 10, so the real Kotlin/new-DSL migration is deferred to a follow-up.
• proguard-tests/build.gradle.kts: migrated the removed postprocessing {} block to isMinifyEnabled/isShrinkResources.
• common/build.gradle.kts, storage/build.gradle.kts: removed a dangling consumerProguardFiles("proguard-rules.pro") pointing at a file that's never existed — silently ignored under AGP 8, hard-fails release builds under AGP 9. Neither module has dependencies needing consumer keep rules.
• auth, database, firestore, storage: implementation(platform(libs.firebase.bom)) → api(platform(libs.firebase.bom)), fixing an AGP 9 dependency-resolution regression where the BOM's version constraint wasn't propagating to modules already exposing these artifacts via api.
• buildSrc/src/main/kotlin/Config.kt: compileSdk 36 → 37 (targetSdk intentionally left at 36 - all modules set it explicitly, so AGP 9's "target defaults to compile" default never fires; target ≤ compile is a valid combination).

---

Maintainer note: Fixes internal CPRN-146

[gemini-code-assist]

Code Review

This pull request upgrades the Android Gradle Plugin to version 9.3.0, updates Firebase BOM dependencies from implementation to api across multiple modules, and removes consumer ProGuard files from common and storage modules. Additionally, it replaces the experimental postprocessing block with standard minification properties in the proguard-tests module. The reviewer recommends specifying default Android ProGuard rules when enabling minification to prevent potential runtime crashes due to aggressive shrinking or obfuscation.

[demolaf]

• Closeschore(deps): bump android-gradle-plugin from 8.10.0 to 9.3.1 #2429
• Related to chore(deps): bump com.vanniktech.maven.publish from 0.34.0 to 0.37.0 #2364
• Related to chore(deps): bump glide from 5.0.7 to 5.0.9 #2430
• Related to chore(deps): bump androidx.core:core-ktx from 1.13.1 to 1.19.0 #2371
• Related to chore(deps): bump androidx.compose:compose-bom from 2026.06.01 to 2026.08.00 #2451

Dependabot's com.vanniktech.maven.publish bump (0.34.0 → 0.37.0, #2364) fails CI because 0.36.0+ requires AGP ≥ 8.13.0, and no AGP 8.x release is compatible with this repo's Gradle 9.7.0 wrapper (AGP 8.11–8.13.x depend on an internal Gradle API removed in 9.6.0). This upgrades AGP to 9.3.0 to unblock it — that part alone has no consumer impact, verified by publishing to mavenLocal() and confirming the AAR metadata is unchanged from the pre-upgrade baseline.

It also bumps compileSdk 36 → 37, to unblock a separate cluster of stuck dependabot PRs (#2430 glide, #2371 core-ktx, #2451 compose-bom) whose newer versions were themselves built against compileSdk 37 and can't be consumed while we're at 36. This part does have real consumer impact: the published AAR now stamps minCompileSdk=37, so consumers still on AGP 8.10.0 (max recommended compileSdk 36) will need to upgrade AGP to pick up the next FirebaseUI-Android release. That's a deliberate, accepted tradeoff for unblocking those PRs, not an oversight.

#2429 is dependabot's own attempt at this same AGP bump (8.10.0 → 9.3.1) - it hit the identical org.jetbrains.kotlin.android/AGP-9-defaults wall this PR already resolves, so merging this supersedes it.

• gradle.properties: added android.builtInKotlin=false and android.newDsl=false to keep org.jetbrains.kotlin.android working under AGP 9's defaults - both flags are deprecated and removed in AGP 10, so the real Kotlin/new-DSL migration is deferred to a follow-up.
• proguard-tests/build.gradle.kts: migrated the removed postprocessing {} block to isMinifyEnabled/isShrinkResources.
• common/build.gradle.kts, storage/build.gradle.kts: removed a dangling consumerProguardFiles("proguard-rules.pro") pointing at a file that's never existed — silently ignored under AGP 8, hard-fails release builds under AGP 9. Neither module has dependencies needing consumer keep rules.
• auth, database, firestore, storage: implementation(platform(libs.firebase.bom)) → api(platform(libs.firebase.bom)), fixing an AGP 9 dependency-resolution regression where the BOM's version constraint wasn't propagating to modules already exposing these artifacts via api.
• buildSrc/src/main/kotlin/Config.kt: compileSdk 36 → 37 (targetSdk intentionally left at 36 - all modules set it explicitly, so AGP 9's "target defaults to compile" default never fires; target ≤ compile is a valid combination).

---

Maintainer note: Fixes internal CPRN-146

[gemini-code-assist]

Code Review

This pull request upgrades the Android Gradle Plugin to version 9.3.0, updates Firebase BOM dependencies from implementation to api across multiple modules, and removes consumer ProGuard files from common and storage modules. Additionally, it replaces the experimental postprocessing block with standard minification properties in the proguard-tests module. The reviewer recommends specifying default Android ProGuard rules when enabling minification to prevent potential runtime crashes due to aggressive shrinking or obfuscation.

[demolaf]

• Closeschore(deps): bump android-gradle-plugin from 8.10.0 to 9.3.1 #2429
• Related to chore(deps): bump com.vanniktech.maven.publish from 0.34.0 to 0.37.0 #2364
• Related to chore(deps): bump glide from 5.0.7 to 5.0.9 #2430
• Related to chore(deps): bump androidx.core:core-ktx from 1.13.1 to 1.19.0 #2371
• Related to chore(deps): bump androidx.compose:compose-bom from 2026.06.01 to 2026.08.00 #2451

Dependabot's com.vanniktech.maven.publish bump (0.34.0 → 0.37.0, #2364) fails CI because 0.36.0+ requires AGP ≥ 8.13.0, and no AGP 8.x release is compatible with this repo's Gradle 9.7.0 wrapper (AGP 8.11–8.13.x depend on an internal Gradle API removed in 9.6.0). This upgrades AGP to 9.3.0 to unblock it — that part alone has no consumer impact, verified by publishing to mavenLocal() and confirming the AAR metadata is unchanged from the pre-upgrade baseline.

It also bumps compileSdk 36 → 37, to unblock a separate cluster of stuck dependabot PRs (#2430 glide, #2371 core-ktx, #2451 compose-bom) whose newer versions were themselves built against compileSdk 37 and can't be consumed while we're at 36. This part does have real consumer impact: the published AAR now stamps minCompileSdk=37, so consumers still on AGP 8.10.0 (max recommended compileSdk 36) will need to upgrade AGP to pick up the next FirebaseUI-Android release. That's a deliberate, accepted tradeoff for unblocking those PRs, not an oversight.

#2429 is dependabot's own attempt at this same AGP bump (8.10.0 → 9.3.1) - it hit the identical org.jetbrains.kotlin.android/AGP-9-defaults wall this PR already resolves, so merging this supersedes it.

• gradle.properties: added android.builtInKotlin=false and android.newDsl=false to keep org.jetbrains.kotlin.android working under AGP 9's defaults - both flags are deprecated and removed in AGP 10, so the real Kotlin/new-DSL migration is deferred to a follow-up.
• proguard-tests/build.gradle.kts: migrated the removed postprocessing {} block to isMinifyEnabled/isShrinkResources.
• common/build.gradle.kts, storage/build.gradle.kts: removed a dangling consumerProguardFiles("proguard-rules.pro") pointing at a file that's never existed — silently ignored under AGP 8, hard-fails release builds under AGP 9. Neither module has dependencies needing consumer keep rules.
• auth, database, firestore, storage: implementation(platform(libs.firebase.bom)) → api(platform(libs.firebase.bom)), fixing an AGP 9 dependency-resolution regression where the BOM's version constraint wasn't propagating to modules already exposing these artifacts via api.
• buildSrc/src/main/kotlin/Config.kt: compileSdk 36 → 37 (targetSdk intentionally left at 36 - all modules set it explicitly, so AGP 9's "target defaults to compile" default never fires; target ≤ compile is a valid combination).

---

Maintainer note: Fixes internal CPRN-146

[gemini-code-assist]

Code Review

This pull request upgrades the Android Gradle Plugin to version 9.3.0, updates Firebase BOM dependencies from implementation to api across multiple modules, and removes consumer ProGuard files from common and storage modules. Additionally, it replaces the experimental postprocessing block with standard minification properties in the proguard-tests module. The reviewer recommends specifying default Android ProGuard rules when enabling minification to prevent potential runtime crashes due to aggressive shrinking or obfuscation.